python: infinite loop in the tarfile module via crafted TAR archive

A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...

container-tools:2.0 security update

buildah 1.11.6-8.0.1 - Reduce unnecessary writable mounts in NaiveDiffDriver Orabug: 31025483 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-8 - exclude i686 arch - Related: 1821193 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file...

CVE-2020-28588

A flaw read uninitialized values in the Linux kernel syscall implementation on 32 bit-systems was found in the way user reading /proc/self/syscall. A local user could use this flaw to read three 64 bits uninitialized values, but cannot control which values. The highest threat from this...

USN-4720-1 apport vulnerabilities

Itai Greenhut discovered that Apport incorrectly parsed certain files in the /proc filesystem. A local attacker could use this issue to escalate privileges and run arbitrary code. CVE-2021-25682, CVE-2021-25683 Itai Greenhut discovered that Apport incorrectly handled opening certain special files...

UBUNTU-CVE-2021-25683

It was discovered that the getstarttime function in data/apport did not properly parse the /proc/pid/stat file from the kernel...

CVE-2021-25683

It was discovered that the getstarttime function in data/apport did not properly parse the /proc/pid/stat file from the kernel...

CVE-2021-25682

It was discovered that the getpidinfo function in data/apport did not properly parse the /proc/pid/status file from the kernel...

PT-2021-16753

Name of the Vulnerable Software and Affected Versions apport affected versions not specified Description The issue concerns the get starttime function in data/apport, which does not properly parse the /proc/pid/stat file from the kernel. This affects the correct analysis of the file...

Oppo SM8250 Buffer Error Vulnerability

The Oppo SM8250 is a driver for the Snapdragon 855 chip from the Chinese company Oppo. OPPO has a buffer error vulnerability that originates from /SM8250QMaster/android/vendor/oppocharger/oppo/chargeric/oppoda9313.c, which fails to check the parameter buf when writing in proc working mode to writ...

PT-2020-12882

Name of the Vulnerable Software and Affected Versions oppo vooc affected versions not specified Description The issue is related to the function proc fastchg fw update write in the file oppo vooc.c, where it fails to check the parameter len. This oversight results in a vulnerability...

PT-2020-12883

Name of the Vulnerable Software and Affected Versions Oppo charger affected versions not specified Description The issue is caused by a failure to check the parameter buf in the function proc work mode write in the file oppo da9313.c. This lack of validation leads to a vulnerability. No informati...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

Race condition

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

UBUNTU-CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746: Concurrent Execution using Shared Resource with Improper Synchronization

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

Information Disclosure

kernel is vulnerable to information disclosure.It incorrectly writes to the /proc/sys/vm/cmmtimeout file.This flaw allows to local user see the kernel stack information leak on s390/s390x...