80 matches found
CVE-2026-61711
A flaw was found in BuildKit. A custom frontend could craft a build request with an invalid security mode, leading to the disabling of Seccomp and AppArmor protections for the build container. This bypasses the intended sandbox mechanisms, potentially allowing for broader impact within the...
dirtyfrag-arm64
dirtyfrag-arm64 Port arm64/aarch64 de V4bel/dirtyfrag CVE-2026-43284, CVE-2026-43500. Testé sur Ubuntu 24.04.4 LTS avec linux-aws 6.17.0-1013-aws sur AWS Graviton le plus récent disponible au moment de cette rédaction. Analyse complète avec analyse de contournement d'AppArmor, notes de durcisseme...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098895)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098895 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN i...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...
BuildKit: Custom frontend could bypass Seccomp/AppArmor
Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...
AZL-97032 CVE-2026-61711 affecting package moby-engine 25.0.3-19
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...
CVE-2026-61711
In BuildKit versions prior to 0.31.1, the file executor/oci/spec_linux.go treated an invalid SecurityMode value from a crafted build request as non-sandbox mode without requiring the security.insecure entitlement, disabling Seccomp and AppArmor protections for the build container. Linux capabilit...
CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...
CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...
EUVD-2026-62838
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...
CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...
Linux Distros Unpatched Vulnerability : CVE-2024-5300
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction...
snapd: systemd: Canonical snapd: Information disclosure of system password hashes via AppArmor bypass
A flaw was found in Canonical snapd. The base AppArmor security profile configuration in snapd inadvertently allows strictly confined snap applications to bypass intended sandbox restrictions. This enables a compromised or malicious snap application, when running as root, to access sensitive syst...
RHCOS 4 : OpenShift Container Platform 4.2 runc (RHSA-2019:4074)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:4074 advisory. - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc CVE-2019-16884 Note that Nessus has not tested for this...
CVE-2026-34177 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden lxd/project/limits/permissions.go, which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote...
MiracleLinux 9 : runc-1.1.9-1.el9 (AXSA:2023-6674:03)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6674:03 advisory. golang: crypto/tls: large handshake records may cause panics CVE-2022-41724 runc: Rootless runc makes /sys/fs/cgroup writable CVE-2023-25809 runc:...
EUVD-2017-3180
Malware in sbrugna...
EUVD-2017-17840
Malware in sbrugna...