76 matches found
UBUNTU-CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-55554 Dompdf: Chroot Validation Bypass
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
EUVD-2026-50011
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-55554
CVE-2026-55554 affects Dompdf (PHP HTML-to-PDF converter). The issue stems from validateLocalUri() using a realpath()-based normalization and a prefix strpos() check to enforce chroot boundaries. Because trailing directory separators are stripped during normalization, a defined chroot like /var/w...
CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-55554: Improper Input Validation
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
tetragon-lab
How it works This poc use copyfail exploit to overwrite page-...
CVE-2025-15547
By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic...
CVE-2025-15576
CVE-2025-15576 describes a jail/chroot escape in FreeBSD. When two sibling jails are restricted to separate filesystem trees, processes in the two jails can still exchange directory descriptors via a unix domain socket and access a shared directory mounted with nullfs. During a filesystem name lo...
CVE-2025-15576 Jail chroot escape via fd exchange with a different jail
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has configured one. In this...
CVE-2025-15576 Jail chroot escape via fd exchange with a different jail
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has configured one. In this...
CVE-2025-15547 Jail escape by a privileged user via nullfs
By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic...
CVE-2025-15547 Jail escape by a privileged user via nullfs
By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic...
FreeBSD : FreeBSD -- Jail chroot escape via fd exchange with a different jail (a88f5b2d-11e9-11f1-8148-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a88f5b2d-11e9-11f1-8148-bc241121aa0a advisory. If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the t...
FreeBSD -- Jail chroot escape via fd exchange with a different jail
Problem Description: If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has...
FreeBSD-SA-26:04.jail
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:04.jail Security Advisory The FreeBSD Project Topic: Jail chroot escape via fd exchange with a different jail Category: core Module: jail Announced:...
EUVD-2013-1887
Malware in sbrugna...