Cargo not respecting umask when extracting crate archives

The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed b...

CVE-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

Cargo security breach

Cargo is a Rust package manager open-sourced by The Rust Programming Language. A security vulnerability exists in versions of Cargo prior to 0.72.2, which stems from the fact that on UNIX-like systems, Cargo does not take into account the umask setting when extracting crate archives...

Fedora: Security Advisory for kitty (FEDORA-2023-3746647cc3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-235 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately befor...

Fedora 37 : cups (2023-9dbd5b28d4)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9dbd5b28d4 advisory. 2218124 - The command cancel -x does not remove job files 2218123 - Delays printing to lpd when reserved ports are exhausted Security fix for...

Debian dla-3476 : cups - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3476 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3476-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-34241

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...

CVE-2023-34241 CUPS vulnerable to use-after-free in cupsdAcceptClient()

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...

CVE-2023-34241

CVE-2023-34241 (CUPS) affects OpenPrinting CUPS prior to 2.4.6. A use-after-free occurs in cupsdAcceptClient when logging data after a connection closes due to the function httpClose(con->http) freeing the pointer; cupsdLogClient then passes that freed pointer to httpGetHostname. This can happ...

CVE-2023-34241 CUPS vulnerable to use-after-free in cupsdAcceptClient()

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...

The vulnerability of the `peek_for_as4_capability` function in the software for implementing network routing on Unix-like systems allows a hacker to cause a service failure.

The vulnerability of the peekforas4capability function in the software for implementing network routing on Unix-like systems is related to deficiencies in the use of the assert function. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Fedora: Security Advisory for kitty (FEDORA-2023-a354113801)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the bgpd software module for implementing network routing on Unix-like systems allows a hacker to cause service interruptions.

The vulnerability of the bgpd software module for implementing routing on Unix-like systems is related to the issue where an operation is executed outside the buffer in memory when processing BGP OPEN messages with a length of one octet or word. Exploiting this vulnerability allows a remote...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gradle (SUSE-SU-2023:2203-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2203-1 advisory. - CVE-2021-32751: Fixed arbitrary code execution in application plugin and the gradlew script bsc1188569...

SUSE: Security Advisory (SUSE-SU-2023:2096-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the BGP OPEN Message Handler component of the networking routing implementation software on Unix-like systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely.

The vulnerability of the BGP OPEN Message Handler component of the networking routing implementation software on Unix-like systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS : Netty vulnerabilities (USN-6049-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6049-1 advisory. It was discovered that Netty's Zlib decoders did not limit memory allocations. A remote attacker could possibly use...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gradle (SUSE-SU-2023:1867-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:1867-1 advisory. - CVE-2021-29428: Fixed a local privilege escalation through system temporary directory. bsc1184807 Tenab...

Sudo 安全漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A security vulnerability exists in versions of Sudo prior to 1.9.13 that stems from the fact that Sudo does not escape control characters in log messages...