CLSA-2025-1756929133 git: Fix of CVE-2025-27613

CVE-2025-27613: fix issue with file creation and truncation when running gitk without additional command arguments from untrusted repositories...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs due to a LaTeX blocklist bypass in the LaTeX processing functionality. The LaTeX module fails to enforce its blocklist properly, allowing specially crafted malicious flashcards to create arbitrary...

CVE-2025-58355: Improper Limitation of a Pathname to a Restricted Directory

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0...

UBUNTU-CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

CVE-2025-7039 Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

SUSE CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

SUSE SLES15: git / git-arch / git-core / git-cvs / git-daemon / git-doc / etc (SUSE-SU-2025:03037-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03037-1 advisory. Updated to 2.43.7 jscPED-13447: - CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk bsc1245938 -...

Linux Distros Unpatched Vulnerability : CVE-2021-25317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Clou...

PT-2025-35649

Name of the Vulnerable Software and Affected Versions Soft Serve versions prior to 0.10.0 Description Soft Serve is a self-hostable Git server for the command line. The SSH API allows attackers to create or override arbitrary files with uncontrolled data using the --output variable. Recommendatio...

Security update for git

This update for git fixes the following issues: Updated to 2.43.7 jscPED-13447: CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk bsc1245938 CVE-2025-27614: Fixed arbitrary script execution via repo clonation in Gitk bsc1245939 CVE-2025-46835: Fixed arbitrary writable...

CVE-2025-9474

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach...

SUSE-SU-2025:03022-1 Security update for git

This update for git fixes the following issues: - CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk bsc1245938 - CVE-2025-46835: Fixed arbitrary writable file creation when cloning untrusted repository in Git GUI bsc1245942 - CVE-2025-48384: Fixed arbitrary writable fi...

Linux Distros Unpatched Vulnerability : CVE-2018-1000801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - okular version 18.08 and earlier contains a Directory Traversal vulnerability in function unpackDocumentArchive... in core/document.cpp that can result in...

Linux Distros Unpatched Vulnerability : CVE-2020-29582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and...

CVE-2025-44002 Arbitrary File Creation via Symbolic Link leading to Denial-of-Service

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during...

CVE-2025-44002 Arbitrary File Creation via Symbolic Link leading to Denial-of-Service

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during...

Exploit for CVE-2025-9074

CVE-2025-9074 – Docker Desktop Windows Container→Host Write...

CVE-2025-8612 AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability

AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AOMEI Backupper Workstation. An attacker must first obtain the ability to execute low-privileged code on the target...

Linux Distros Unpatched Vulnerability : CVE-2021-37712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The npm package tar aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability...