19163 matches found
openSUSE 15 Security Update : umoci (openSUSE-SU-2021:1863-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1863-1 advisory. - Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal...
runc: vulnerable to symlink exchange attack
The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity ...
jenkins: Arbitrary file read vulnerability in workspace browsers
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks...
CVE-2021-32610
In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...
CVE-2021-32610
In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...
UBUNTU-CVE-2021-32610
In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...
PT-2021-5776 · Npm +9 · Node-Tar +9
Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.2.3 node-tar versions prior to 4.4.15 node-tar versions prior to 5.0.7 node-tar versions prior to 6.1.2 Description: The issue is related to insufficient symlink protection in the node-tar module for handling tar...
DRUPAL-CORE-2021-004
The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. The vulnerability is mitigated by the fact that Drupal core's use of the Archive\Tar library is not vulnerable, as it does not permit symlinks. Exploitation may be possible if contrib o...
PT-2021-5004 · Unknown +9 · Archive Tar +9
Name of the Vulnerable Software and Affected Versions: Archive Tar versions prior to 1.4.14 Description: The issue is related to incorrect link resolution before file access, potentially allowing an attacker to impact data integrity, availability, and confidentiality. It involves symlinks referri...
Links in archive can create arbitrary directories
When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point. rust use std::io, io::Result; use tar::Archive,...
RUSTSEC-2021-0080 Links in archive can create arbitrary directories
When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point. rust use std::io, io::Result; use tar::Archive,...
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
...
openSUSE 15 Security Update : avahi (openSUSE-SU-2021:1845-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1845-1 advisory. - avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows...
openSUSE 15 Security Update : jetty-minimal (openSUSE-SU-2021:2005-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2005-1 advisory. - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a...
EulerOS 2.0 SP5 : glib2 (EulerOS-SA-2021-2215)
According to the version of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path that is a dangli...
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
...
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot which allows local users to gain privileges via a symlink attack in an image.
...
PT-2023-3545 · Podman +6 · Podman +6
Name of the Vulnerable Software and Affected Versions: podman affected versions not specified Description: A Time-of-check Time-of-use TOCTOU flaw was found in podman, which may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume. This could allow...
openSUSE: Security Advisory for containerd, (openSUSE-SU-2021:1954-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...