Vaisha Bernard

An integer overflow or wraparound occurs in Windows Kerberos, which allows an authorized attacker to cause a denial of service over a network.

Files or directories accessible to external parties allow an authorized attacker to disclose sensitive information locally, which can affect the system.

Weak authentication allows an unauthorized attacker to perform spoofing over a network, which enables them to affect the system.

Name of the Vulnerable Software and Affected Versions: Blueman versions prior to 2.1.4 Description: The issue is related to an argument injection vulnerability in the DhcpClient method of the D-Bus interface to blueman-mechanism. This vulnerability can be exploited depending on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. On systems with ISC DHCP client, attackers can pass arguments to `ip link` with the interface name, potentially bringing down an interface or adding an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Recommendations: For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules.

The issue is related to the lack of input validation on the Locale property in an apt transaction. This allows an unprivileged user to supply a full path to a writable directory, enabling aptd to read a file as root. By utilizing a symlink, an unprivileged user can determine the existence of any files on the system as root, based on the presence or absence of an error message.

The issue is related to the package manager PackageKit, which provided detailed error messages to unprivileged callers. These error messages exposed information about the presence and mimetype of files that the user would not be able to determine on their own. This information leak could allow an attacker to gain access to confidential data.