PT-2022-27580 · Freedom Of The Press · Securedrop

Name of the Vulnerable Software and Affected Versions: Freedom of the Press SecureDrop affected versions not specified Description: A critical issue was found in Freedom of the Press SecureDrop, affecting some unknown functionality of the file gpg-agent.conf. The manipulation of this issue leads ...

CLSA-2022-1671124065 rpm: Fix of 2 CVEs

CVE-2021-35939: validate intermediate symlinks during installation - CVE-2021-35938: set file metadata via fd-based ops for everything but symlinks - Fix file descriptor leak recently introduced in rpmPackageFilesInstall...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

[SECURITY] [DLA 3237-1] node-tar security update

Debian LTS Advisory DLA-3237-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin December 12, 2022 https://wiki.debian.org/LTS Package : node-tar Version : 4.4.6+ds1-3+deb10u2 CVE ID : CVE-2021-37701 CVE-2021-37712 Debian Bug : 993981 Cache poisoning vulnerabilities...

Information Disclosure

github.com/containers/podman is vulnerable to information disclosure. The vulnerability exists because the utils.go does not properly validate the .containerignore or .dockerignore build context if they are symlink outside the build context, allowing an attacker to gain sensitive information...

Debian dla-3237 : node-tar - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3237 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3237-1 [email protected]...

Ubuntu Server snap-confine must_mkdir_and_open_with_perms() Race Condition Vulnerability

Qualys discovered a race condition CVE-2022-3328 in snap-confine, a SUID-root program installed by default on Ubuntu. In this advisory,they tell the story of this vulnerability which was introduced in February 2022 by the patch for CVE-2021-44731 and detail how they exploited it in Ubuntu Server ...

Linux flaws could be chained together to achieve root access

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Two vulnerabilities CVE-2022-41974 and CVE-2022-41973 can either be exploited individually or in combination to lead to local privilege escalation, the first potentially causing a symlink attack a...

Buildah (as part of Podman) vulnerable to Link Following

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

GHSA-4CRW-W8PW-2HMF Buildah (as part of Podman) vulnerable to Link Following

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

DEBIAN-CVE-2022-4122

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

CVE-2022-4122

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

AZL-44526 CVE-2022-4122 affecting package podman for versions less than 5.6.1-2

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

CVE-2022-4122

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

Information disclosure

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

UBUNTU-CVE-2022-4122

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

CVE-2022-4122

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...

CVE-2022-4122

CVE-2022-4122 affects podman (and the podman-build-related components) via a symlink-following flaw in reading .containerignore and .dockerignore, causing information disclosure. Connected MARINER data specifies: affected podman versions

CVE-2022-4122

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...