PYSEC-2026-2998 pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

Summary The fix for CVE-2026-33509 prevents setting storagefolder inside PKGDIR or userdir, but does NOT protect the Flask session directory /tmp/pyLoad/flask. An authenticated attacker can set storagefolder to the session directory and download session files of other users via /files/get/, leadi...

php54 security and bug fix update

php54 2.0-1 - fix incorrect selinux contexts 1194332 php54-php 5.4.40-1 - rebase to PHP 5.4.40 for various security fix 1209887 5.4.37-1 - rebase to PHP 5.4.37 5.4.36-1 - rebase to PHP 5.4.36 1168193 - fix package name in description - php-fpm own session dir php54-php-pecl-zendopcache 7.0.4-3 -...

CVE-2011-2473

The dodumpdata function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opdpipe file, a different vulnerability than CVE-2011-1760...

PT-2011-3894

Name of the Vulnerable Software and Affected Versions OProfile versions 0.9.6 and earlier Description The issue allows local users to potentially gain privileges through shell metacharacters in certain arguments, including the --vmlinux, --session-dir, and --xen arguments. This is related to the...