CVE-2022-37703

Suggested description In Amanda 3.5.1, an information leak vulnerability was found in calcsize SUID binary. The attacker can abuse the vulnerability to know if a directory exist or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via a race condition in the sender's directory scanning process. An attacker can access files outside the intended directory by manipulating symlinks between the lstat and opendir calls. Remediation A fix was pushed into...

CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

EUVD-2026-58039

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

PT-2026-71639

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's directory scanning logic. This occurs when an attacker manipulates symlinks in a path component of the scanned tree, replacing a symlink with a directory...

CVE-2026-52078

opendir stack overflow via wcscat on MAXPATH path...

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

...

EEF-CVE-2025-48041 SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

Summary Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh ssh\sftp modules allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh\sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3...

CVE-2025-48041 SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh sshsftp modules allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/sshsftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and...

CLSA-2025-1751888935 squashfs-tools: Fix of CVE-2021-41072

CVE-2021-41072: fix squashfsopendir directory traversal vulnerability by restricting unsquashfs write operations...

CLSA-2025-1750782908 squashfs-tools: Fix of CVE-2021-40153

CVE-2021-40153: fix directory traversal vulnerability in squashfsopendir by validating filenames before creating new files...

CVE-2024-8006: NULL Pointer Dereference

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcapfindalldevsex. One of the function arguments can be a filesystem path, which normally means a directory with...

Libpcap code-related vulnerabilities

libpcap is a portable C/C ++ library for network traffic capture from the Tcpdump team. A code issue vulnerability exists in libpcap, which stems from improper handling of filesystem paths in the pcapfindalldevsex function. When the specified path cannot be used as a directory, the function fails...

SUSE CVE-2021-40153

squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations...

SUSE CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an...

CVE-2022-37703

An information leak vulnerability was found in Amanda in the calcsize SUID binary. This flaw allows an attacker to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an arbitrary path...

CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an...

DEBIAN-CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an...

UBUNTU-CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an...

CVE-2022-37703

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an...