CVE-2026-95835

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

EUVD-2026-87239

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

CVE-2026-95835

The kitty terminal emulator (versions 0.25.0 before 0.49.0 ) contains a missing authorization vulnerability in its askpass escape code handler. The root cause is located in handle_remote_askpass() within kitty/window.py, which opens a POSIX shared memory object but fails to verify if the object i...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

FreeBSD : FreeBSD -- TOCTOU race in POSIX shared memory large page configuration (ef63188f-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ef63188f-a0ff-11f1-ae1f-bc241121aa0a advisory. The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This ...

XNU - POSIX Shared Memory Mappings have Incorrect Maximum Protection

XNU - POSIX Shared Memory Mappings have Incorrect Maximum Protection When the mmap syscall is invoked on a POSIX shared memory segment DTYPEPSXSHM, pshmmmap maps the shared memory segment's pages into the address space of the calling process. It does this with the following code: int prot =...

CVE-2017-1087: Improper Limitation of a Pathname to a Restricted Directory

In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system. As a result, a malicious user th...

Design/Logic Flaw

The SharedMemory::Create function in memory/sharedmemoryposix.cc in Google Chrome before 29.0.1547.57 uses weak permissions under /dev/shm/, which allows attackers to obtain sensitive information via direct access to a POSIX shared-memory file...

CVE-2013-2905

The SharedMemory::Create function in memory/sharedmemoryposix.cc in Google Chrome before 29.0.1547.57 uses weak permissions under /dev/shm/, which allows attackers to obtain sensitive information via direct access to a POSIX shared-memory file...

CVE-2013-2905

Removed by vendor...

CVE-2013-2905: Undefined Security Weakness

The SharedMemory::Create function in memory/sharedmemoryposix.cc in Google Chrome before 29.0.1547.57 uses weak permissions under /dev/shm/, which allows attackers to obtain sensitive information via direct access to a POSIX shared-memory file...