CVE-2026-25710

The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown arbitrary files in the system...

CVE-2026-25710

The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown arbitrary files in the system...

MiracleLinux 9 : pmix-3.2.3-5.el9 (AXSA:2024-8100:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8100:01 advisory. pmix: race condition allows attackers to obtain ownership of arbitrary files CVE-2023-41915 Tenable has extracted the preceding description block directly fr...

CLSA-2025-1763123299 pmix: Fix of CVE-2023-41915

CVE-2023-41915: prevent attackers from obtaining ownership of arbitrary files by fixing race condition during execution of library code with UID 0...

CVE-2025-64437: Improper Link Resolution Before File Access

KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node ...

KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

Summary Short summary of the problem. Make the impact and severity as clear as possible. It is possible to trick the virt-handler component into changing the ownership of arbitrary files on the host node to the unprivileged user with UID 107 due to mishandling of symlinks when determining the roo...

EUVD-2018-13783

Malware in sbrugna...

Nix、lix和GNU Guix 竞争条件问题漏洞

GNU Guix is a product of the U.S. et all is a product of the U.S. GNU community.GNU Guix is an open source, cross-platform program package manager. lix et all is a product of the lix open source.lix is a package manager.Nix et all is a product of the Nix open source.Nix is a powerful package...

RLSA-2024:2199 Important: pmix security update

The Process Management Interface PMI provides process management functions for MPI implementations. PMI Exascale PMIx provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security Fixes: pmix: race condition allows attacker...

USN-6434-1 pmix vulnerability

Francois Diakhate discovered that PMIx did not properly handle race conditions in the pmix library, which could lead to unwanted privilege escalation. An attacker could possibly use this issue to obtain ownership of an arbitrary file on the filesystem, under the default configuration of the...

AZL-29702 CVE-2023-41915 affecting package pmix for versions less than 4.1.3-1

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0...

UBUNTU-CVE-2023-41915

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0...

CVE-2023-41915: Concurrent Execution using Shared Resource with Improper Synchronization

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0...

CVE-2018-21269: Improper Link Resolution Before File Access

checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink...

CVE-2017-18925: Improper Link Resolution Before File Access

opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack...

CVE-2020-6236

SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admingroup privileges to change ownership and permissions including S-user ID bit s-bit of arbitrary files remotely. This results in the possibility to execute these files as root user from a...

OPENSUSE-SU-2020:0015-1 Security update for trousers

This update for trousers fixes the following issues: - CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package bsc1157651. This update was imported from the...

CVE-2018-10380: Improper Link Resolution Before File Access

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2017-18188: Improper Link Resolution Before File Access

OpenRC opentmpfiles through 0.1.3, when the fs.protectedhardlinks sysctl is turned off, allows local users to obtain ownership of arbitrary files by creating a hard link inside a directory on which "chown -R" will be run...

CVE-2018-6954

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. Th...