EUVD-2026-31777

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. makespecialfile passes the tar header's linkname to link without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

pnpm security vulnerabilities

PNPM is a package manager developed by the open-source project Pnpm. Versions of Pnpm prior to 10.28.2 had security vulnerabilities. These vulnerabilities stemmed from the lack of path validation when processing the directories.bin field of packages. This allowed malicious npm packages to modify...

CVE-2025-68954

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to...

ALPINE-CVE-2024-12718

Allows modifying some file metadata e.g. last modified with filter="data" or file permissions chmod with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

CLSA-2025-1740645424 Fix CVE(s): CVE-2023-6597

SECURITY UPDATE: Ability to modify permissions with privileged programs - debian/patches/CVE-2023-6597.patch: Prevent tempfile.TemporaryDirectory class dereference symlinks - CVE-2023-6597...

NetworkManager security update

1.48.10-5.0.3 - Drop 777 permissions from the NetworkManager-dispatcher drop-in directory Orabug: 37581907 1.48.10-5.0.2 - Add a dropin file to make Networkmanager-dispatcher persistent Orabug: 36989910...

NetworkManager security update

1:1.40.16-18.0.3 - Drop 777 permissions from Networkmanager-dispatcher drop-in directory Orabug: 37581862 1:1.40.16-18.0.2 - Add a dropin file to make Networkmanager-dispatcher persistent Orabug: 36989910 1:1.40.16-18.0.1 - disable MPTCP handling by default Orabug: 35081472 - Fix ignore-carrier...

CVE-2020-6236

SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admingroup privileges to change ownership and permissions including S-user ID bit s-bit of arbitrary files remotely. This results in the possibility to execute these files as root user from a...

Ubuntu: Security Advisory (USN-5103-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5103-1: docker.io vulnerability

Lei Wang and Ruizhi Xiao discovered that the Moby Docker engine in Docker incorrectly allowed the docker cp command to make permissions changes in the host filesystem in some situations. A local attacker could possibly use to this to expose sensitive information or gain administrative privileges...

SUSE-SU-2020:1856-1 Security update for openldap2

This update for openldap2 fixes the following issues: - CVE-2020-8023: Fixed a potential local privilege escalation from ldap to root when OPENLDAPCONFIGBACKEND='ldap' was used bsc1172698. - Changed DBCONFIG to root:ldap permissions bsc1172704...

Fedora 18 : glibc-2.16-34.fc18 (2013-15072)

glibc security update : CVE-2013-2207 glibc ptchown: Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal The fix may break chroots if their devpts was not mounted correctly. Fix is to mount the devpts correctly with gid=5. Note that Tenable Networ...

Fedora 19 : glibc-2.17-13.fc19 (2013-15053)

glibc security update : CVE-2012-4412 glibc: strcoll integer overflow leading to buffer overflow CVE-2012-4424 glibc: alloca stack overflow in the strcoll interface CVE-2013-1914 glibc: Stack frame overflow in getaddrinfo when processing entry mapping to long list of address structures...

IRIX /dev/ipfilter Denial of Service vulnerability

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: /dev/ipfilter Denial of Service vulnerability Number: 20020408-01-I Date: April 30, 2002 Reference: CAN-2002-0172 - ----------------------- - --- Issue Specifics --- - ----------------------- SGI has determined that the default...