Petter Reinholdtsen

**Name of the Vulnerable Software and Affected Versions** LinuxCNC versions prior to 2.9.9 **Description** The `rtapi app` component in `linuxcnc-uspace` is installed with SUID root permissions and utilizes the `dlopen()` function to load shared library modules based on a user-supplied module name. Due to insufficient validation of this module name, a path traversal attack is possible, allowing an unprivileged local user to load an arbitrary shared library. Since the process maintains elevated privileges during the loading process, this leads to local privilege escalation to root. **Recommendations** Update LinuxCNC to version 2.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** xrdp versions prior to 0.9.1 **Description** An issue was discovered where the file ~/.vnc/sesman ${username} passwd is created when successfully logging in using RDP into an xrdp session. The content of this file is the equivalent of the user's cleartext password, DES encrypted with a known key. **Recommendations** For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ~/.vnc/sesman ${username} passwd file to minimize the risk of exploitation.