CVE-2024-44178

CVE-2024-44178 describes a vulnerability in macOS where insufficient validation of symlinks could allow an app to modify protected parts of the file system. The issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, and macOS Sequoia 15, per the provided sources. The Red Hat and NVD entries con...

CVE-2024-44178

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to modify protected parts of the file system...

CVE-2024-44131

This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data...

CVE-2024-44131

This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data...

CVE-2024-44131

CVE-2024-44131 concerns Apple’s FileProvider symlink handling. The issue arises from improper validation of symlinks, enabling a malicious app running with elevated file operation privileges to access or exfiltrate data via symlink manipulation. Apple states fixes are in iOS 18, iPadOS 18, and ma...

PT-2024-30973 · Apple · Ios +3

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 18 iPadOS versions prior to 18 macOS Sequoia versions prior to 15 Description: This issue was addressed with improved validation of symlinks, allowing unauthorized apps to access sensitive user data, including Health...

PT-2024-31009 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.7.1 macOS versions prior to 15 Description: This issue is related to improved validation of symlinks. An app may be able to access sensitive user data due to a TOCTOU vulnerability in macOS's diskarbitrationd,...

OESA-2024-2132 clamav security update

Clam AntiVirus clamav is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command lin...

Fedora 40 : clamav (2024-e8f7a74693)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e8f7a74693 advisory. Update to 1.0.7 CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with...

SUSE SLES12 Security Update : clamav (SUSE-SU-2024:3228-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3228-1 advisory. - Update to version 0.103.12 - CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. bsc123016...

EulerOS 2.0 SP9 : git (EulerOS-SA-2024-2390)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be...

CVE-2024-45845

Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-45593. Reason: This record is a reservation duplicate of CVE-2024-45593. Notes: All CVE users should reference CVE-2024-45593 instead of this record. All references and descriptions in this record have been removed to prevent...

CVE-2024-45845

Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-45593. Reason: This record is a reservation duplicate of CVE-2024-45593. Notes: All CVE users should reference CVE-2024-45593 instead of this record. All references and descriptions in this record have been removed to prevent...

CVE-2024-45845

...

CVE-2024-45845

...

CVE-2024-45845

CVE-2024-45593 relates to the Nix package manager. In affected releases prior to 2.24.6, a bug in Nix 2.24-era code allows a substituter or malicious user to craft a NAR that, when unpacked, can write to arbitrary file-system locations accessible to the Nix process, including with root privileges...

CVE-2024-45845

Removed by vendor...

SUSE CVE-2024-20506

A vulnerability in the ClamD service module of Clam AntiVirus ClamAV versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...