Apptainer 安全漏洞

Apptainer is a Linux open source container platform from Apptainer Open Source. A security vulnerability exists in Apptainer version 1.2.0-rc.2, which stems from the introduction of an invalid privilege drop when requesting container network settings, resulting in subsequent functions being calle...

PT-2023-26477 · Apptainer · Apptainer

Name of the Vulnerable Software and Affected Versions: Apptainer versions 1.2.0-rc.2 through 1.2.0 Description: Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are...

SUSE CVE-2005-0070

Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files...

SUSE CVE-2005-0099

The SDL port of abuse abuse-SDL before 2.00 does not properly drop privileges before creating certain files, which allows local users to create or overwrite arbitrary files...

SUSE CVE-2006-2427

freshclam in 1 Clam Antivirus ClamAV 0.88 and 2 ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file...

SUSE CVE-2006-3084

The 1 ftpd and 2 ksu programs in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not kno...

SUSE CVE-2008-0008

The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from 1 setresuid, 2 setreuid, 3 setuid, and 4 seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as...

SUSE CVE-2011-2527

The changeprocessuid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host...

SUSE CVE-2017-11747

main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a...

SUSE CVE-2017-13649

UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command. NOTE: t...

SUSE CVE-2017-14159

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, ...

SUSE CVE-2019-20044

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULEPATH=/dir/with/module zmodload with a module that calls setuid...

SUSE CVE-2020-24330

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed...

USN-5439-1 accountsservice vulnerability

Gunnar Hjalmarsson discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cause AccountsService to crash or stop responding, resulting in a denial of service. CVE-2022-1804...

CLSA-2022-1648138003 Fix CVE(s): CVE-2019-20044, CVE-2021-45444

SECURITY UPDATE: Regain dropped privileges - debian/patches/CVE-2019-20044-pre.patch: change the order of the calls to setgid this should go first and setuid in Src/options.c. - debian/patches/CVE-2019-20044-1.patch: add extra checks to drop privileges securely in Src/options.c. -...

OPENSUSE-SU-2021:1642-1 Security update for postrsd

postrsd was updated to release 1.11 boo1180251: Drop group privileges as well as user privileges Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. CVE-2020-35573 - Update to release 1.6 Fix endianness issue with SHA-1 implementation Add dual stack...

Security update for postrsd (moderate)

openSUSE Security Update: Security update for postrsd Announcement ID: openSUSE-SU-2021:1642-1 Rating: moderate References: 1180251 Cross-References: CVE-2020-35573 CVSS scores: CVE-2020-35573 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ...

SUSE SLES15 Security Update : avahi (SUSE-SU-2021:1845-1)

This update for avahi fixes the following issues : CVE-2021-3468: avoid infinite loop by handling HUP event in clientwork bsc1184521. CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh bsc1180827 Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on...

trousers: fails to drop the root gid privilege when no longer needed

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed...

OPENSUSE-SU-2021:0370-1 Security update for avahi

This update for avahi fixes the following issues: - CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh bsc1180827 - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Add sudo to requires: used to drop privileges. This...