CVE-2022-21944

CVE-2022-21944 is a local privilege-escalation flaw in the watchman systemd unit on openSUSE Backports SLE-15-SP3 and openSUSE Factory. The Unix Symbolic Link (Symlink) Following issue concerns the [email protected] unit, enabling local attackers to escalate to root due to a symlink-related vulne...

CVE-2022-21944 watchman: chown in [email protected] unit allows symlink attack

A UNIX Symbolic Link Symlink Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman version...

Path Traversal in gruntjs/grunt

Description Grunt is a JavaScript task runner, a tool used to automatically perform frequent tasks such as minification, compilation, unit testing, and linting. In GruntJS, file.copy operations in GruntJS are not protected against symlink traversal for both source and destination directories...

SUSE SLED15 / SLES15 Security Update : rust1.55 (SUSE-SU-2022:0171-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0171-1 advisory. - CVE-2022-21658: Fixed race condition in std::fs::removedirall bsc1194767. Tenable has extracted the preceding...

About the security content of macOS Big Sur 11.6.3

About the security content of macOS Big Sur 11.6.3 This document describes the security content of macOS Big Sur 11.6.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

SUSE SLED15 / SLES15 Security Update : rust1.57 (SUSE-SU-2022:0175-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0175-1 advisory. - CVE-2022-21658: Fixed race condition in std::fs::removedirall bsc1194767. Tenable has extracted the preceding...

[SECURITY] [DLA 2901-1] libxfont security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2901-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz January 25, 2022 https://wiki.debian.org/LTS -...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on...

GLSA-202107-03 : libqb: Insecure temporary file

The remote host is affected by the vulnerability described in GLSA-202107-03 libqb: Insecure temporary file It was discovered that libqb used predictable filenames under /dev/shm and /tmp without OEXCL. Impact : A local attacker could perform symlink attacks to overwrite arbitrary files with the...

openSUSE 15 Security Update : rust1.56 (openSUSE-SU-2022:0149-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0149-1 advisory. - Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security...

SUSE SLED15 / SLES15 Security Update : rust1.56 (SUSE-SU-2022:0149-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0149-1 advisory. - CVE-2022-21658: Fixed race condition in std::fs::removedirall bsc1194767. Tenable has extracted the preceding...

SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2022:0135-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0135-1 advisory. - CVE-2011-5325: Fixed tar directory traversal bsc951562. - CVE-2015-9261: Fixed segfalts and application...

DEBIAN-CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

AZL-8337 CVE-2022-21658 affecting package rust for versions less than 1.59.0-1

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

UBUNTU-CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...

CVE-2022-21658 Race condition in std::fs::remove_dir_all in rustlang

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable a race condition enabling symlink following CWE-363. A...