Arbitrary Code Injection

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Arbitrary Code Injection via the unzipiter function due to the lack of validation before unpacking untrusted downloaded packages. An attacker c...

Remote Code Execution (RCE)

osc is vulnerable to remote code injection. An attacker can change downloaded packages to overwrite arbitrary files...

redhat-upgrade-tool: does not check GPG signatures on package installation

It was found that the redhat-upgrade-tool did not check GPG signatures on downloaded and installed packages during the upgrade process...