Sebastian Krahmer

The issue is related to the fence cisco ucs.py script in fence-agents, which does not verify remote SSL certificates. This can potentially allow man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.

The issue allows a local user to potentially escalate privileges by overwriting root-owned files via a symlink. This is possible because lightdm writes in .dmrc and Xauthority files using root permissions while the files are in user-controlled folders.

The issue concerns the nginx http proxy module, which does not verify the peer identity of the HTTPS origin server. This lack of verification could facilitate a man-in-the-middle attack (MITM).

The issue allows a local user to load arbitrary Linux kernel modules.

The issue is an information leak that occurs before the screen lock.

A malicious server could send RPC requests to overwrite files outside of the cryptctl key database.

The issue allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option, due to an incomplete fix for a previous issue. This is possible because Firejail does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero.

The issue allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism. This can be achieved via the --allow-debuggers argument when running on a Linux kernel before 4.8.

The issue allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option, due to the software not considering the .Xauthority case during its attempt to prevent accessing user files with an euid of zero.

The issue allows local users to potentially gain privileges by attaching to the process. This can be demonstrated by sending commands to a PrivSep socket.

The issue allows local users to bypass an intended container protection mechanism and execute arbitrary commands. This can be achieved by triggering an SELinux denial with a crafted file name, handled by the ` set tpath` function, or via a crafted `local id` or `analysis id` field in a crafted XML document to the `run fix` function. The vulnerability is related to the `subprocess.check output` and `commands.getstatusoutput` functions.

A flaw in the systemd timers feature caused world-writable suid files to be created, allowing local attackers to escalate their privileges to root. The issue is related to the `/src/basic/fs-util.c` file.

The issue is related to incorrect file name handling, which can be exploited by remote attackers to execute arbitrary commands by adding shell metacharacters to file names. This is specifically related to the `get rpm nvr by file path temporary` function in `util.py`.

The issue allows remote attackers to obtain sensitive information or cause a denial of service, resulting in an out-of-bounds read and crash. This can be achieved via a crafted type in an ICMP or ICMP6 packet.

The issue allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/. This is due to a problem in the session link x11 socket function in login/logind-session.c in systemd-logind.

The issue concerns multiple directory traversal vulnerabilities in the pam timestamp module. These vulnerabilities allow local users to create arbitrary files or possibly bypass authentication. This can be achieved by including a .. (dot dot) in the `PAM RUSER` value to the `get ruser` function or the `PAM TTY` value to the `check tty` function, which is used by the `format timestamp name` function.

The issue allows remote IPP printers to execute arbitrary commands via shell metacharacters in the model or PDL, related to System V interface scripts generated for queues. This can lead to a violation of confidentiality, integrity, and availability of protected information.

The issue allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments.

The issue involves a race condition in PolkitUnixProcess PolkitSubject, allowing local users to bypass access restrictions. This can be achieved through a setuid process or a pkexec process. Additionally, multiple vulnerabilities exist in the hplip package, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally.

The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process. This can lead to a violation of confidentiality, integrity, and availability of protected information. The `polkit unix process new` API function is used insecurely, contributing to the vulnerability.