kernel: NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...

USN-5169-1: oddjob vulnerability

Matthias Gerstner discovered that there was a race condition in the mkhomedir tool shipped with the oddjob package. An authenticated attacker could use this to setup a symlink attack and change permissions on files on the host filesystem...

flatpak bug fix and enhancement update

An update is available for mozilla-filesystem, sbc, dbus-glib. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list These packages will be released only via the...

flatpak bug fix and enhancement update

An update is available for mozilla-filesystem, sbc, dbus-glib. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list These packages will be released only via the firef...

`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope

It is possible for readDir to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in this issue. This is corrected in this PR by checking if a directory is a symlink before reading from it...

PT-2022-24815 · Tauri · Tauri

Name of the Vulnerable Software and Affected Versions: Tauri versions prior to 1.0.6 Description: Due to missing canonicalization when readDir is called recursively, it was possible to display directory listings outside of the defined fs scope. This required a crafted symbolic link or junction...

@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization

The package @acrontum/filesystem-template before 0.0.2 is vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

Remote Code Execution (RCE)

filesystem-template is vulnerable to remote code execution. The vulnerability exists because it does not escape incoming URL parameters in the fetchRepo API, allowing an attacker to pass and execute malicious code via it...

CVE-2022-21186 Arbitrary Command Injection

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

CVE-2022-21186

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

Acrontum filesystem-template 安全漏洞

Acrontum filesystem-template is a filesystem template from the German company Acrontum. A security vulnerability exists in Acrontum filesystem-template versions prior to 0.0.2 that stems from vulnerability to arbitrary command injection...

The vulnerability of the Filesystem component in Oracle Solaris allows a perpetrator to gain access to read, modify, or delete data, or to cause a service failure.

The vulnerability of the Filesystem component in Oracle Solaris relates to insecure management of privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read, modify, or delete access to data, or cause service failures...

GO-2022-0190 Directory traversal via "go get" command in cmd/go

The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace both '' and '' characters. Specifically, it is only vulnerable in GOPATH mode, but not in module mode the distinction is documented at...

Fedora: Security Advisory for golang-github-google-slothfs (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang-github-shurcool-vfsgen (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-sophaskins-efs2tar-0-0.5.20210317git4db1b0f.fc36

efs2tar is a tool that converts SGI EFS-formatted filesystem images ie, the result of dd-ing a whole device in to a file in to tarballs. It was based entirely on NetBSD's sys/fs/efs...

[SECURITY] Fedora 36 Update: golang-github-google-slothfs-0-0.12.20200727git59c1163.fc36

SlothFS is a FUSE filesystem that provides light-weight, lazily downloaded, read-only checkouts of manifest-based Git projects. It is intended for use wi th Android...

[SECURITY] Fedora 36 Update: golang-github-containerd-continuity-0.2.2-4.fc36

A transport-agnostic, filesystem metadata manifest system...

CVE-2022-35631 Filesystem race on temporary files

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2...

Ubuntu 16.04 ESM : Linux kernel (Azure) vulnerabilities (USN-5541-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5541-1 advisory. Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not perform permission checks correctly in some...