flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

RHEL 9 : bubblewrap and flatpak (RHSA-2024:6355)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6355 advisory. Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces...

Important: bubblewrap and flatpak security update

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fixes: flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 For more details about the security issue...

Important: Red Hat Security Advisory: bubblewrap and flatpak security update

An update for bubblewrap and flatpak is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

CVE-2024-45177

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to persistent cross-site scripting XSS attacks. It was found out that the camera configuration is vulnerable to a persistent cross-site...

CVE-2024-8418

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing...

Malicious code in fworit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ed926bf3a44788ba5620ba3ef2a3d4bb1bf64dd35797dbfafd5e7c9c991a4f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uworut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94a75c1d9dba41b228d5979bb4c983eee613e504985724579e7b775e47227cbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45177

The za-internet C-MOR Video Surveillance system (versions 5.2401 and 6.00PL01 ) is vulnerable to persistent cross-site scripting (XSS) attacks. The root cause is insufficient user input validation within the C-MOR web interface, specifically affecting the camera configuration settings. This allow...

ALSA-2024:6356 Important: bubblewrap and flatpak security update

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fixes: flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 For more details about the security issue...

CVE-2024-45177: Improper Neutralization of Input During Web Page Generation

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to persistent cross-site scripting XSS attacks. It was found out that the camera configuration is vulnerable to a persistent cross-site...

Malicious code in @diotoborg/aperiam-iste (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8b1e84bd8de9f5a3048435ab58b5bb57df28c17c5ecff7a2ac6de63784c3067 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/consectetur-consequuntur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9282f643a0e7520d88d082ff71319849893e610b6ac28c0ce0bf1f1bc031ce48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/illo-amet-architecto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b73e91c63f416e494f7d9d204af037bb6f58c12d895f9a38c38473e50f2ed94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/consequatur-facilis-qui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dec70184c6ca2f4543784f4ab8cecc957a7692d0e4bbd26cd2d8f0a61812bf51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/rem-eum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f393166e307c466a1627df4c9dd74f6aeb84e03a4a2175049e368b1a90710e66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/nam-voluptates-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b1c78d692dd69047016cb20f6be4ee4e759c177708dc8dd7487fd20fa36f3c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...