python: infinite loop in the tarfile module via crafted TAR archive

A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...

container-tools:2.0 security update

buildah 1.11.6-8.0.1 - Reduce unnecessary writable mounts in NaiveDiffDriver Orabug: 31025483 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-8 - exclude i686 arch - Related: 1821193 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file...

CVE-2020-28588

A flaw read uninitialized values in the Linux kernel syscall implementation on 32 bit-systems was found in the way user reading /proc/self/syscall. A local user could use this flaw to read three 64 bits uninitialized values, but cannot control which values. The highest threat from this...

USN-4720-1 apport vulnerabilities

Itai Greenhut discovered that Apport incorrectly parsed certain files in the /proc filesystem. A local attacker could use this issue to escalate privileges and run arbitrary code. CVE-2021-25682, CVE-2021-25683 Itai Greenhut discovered that Apport incorrectly handled opening certain special files...

UBUNTU-CVE-2021-25683

It was discovered that the getstarttime function in data/apport did not properly parse the /proc/pid/stat file from the kernel...

CVE-2021-25682

It was discovered that the getpidinfo function in data/apport did not properly parse the /proc/pid/status file from the kernel...

Oppo SM8250 Buffer Error Vulnerability

The Oppo SM8250 is a driver for the Snapdragon 855 chip from the Chinese company Oppo. OPPO has a buffer error vulnerability that originates from /SM8250QMaster/android/vendor/oppocharger/oppo/chargeric/oppoda9313.c, which fails to check the parameter buf when writing in proc working mode to writ...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

Race condition

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

UBUNTU-CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

CVE-2020-27746

Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem...

Information Disclosure

kernel is vulnerable to information disclosure.It incorrectly writes to the /proc/sys/vm/cmmtimeout file.This flaw allows to local user see the kernel stack information leak on s390/s390x...

Uninitialized Memory Disclosure

Linux kernel is vulnerable to uninitialized memory disclosure. Possibility of limited and random memory access when reading the /proc/sys/kernel/rhfeatures file...

kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c

A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system...

kernel: kernel stack information leak on s390/s390x

A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmmtimeout file. This flaw allows a local user to see the kernel data...

kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features

A flaw memory disclosure flaw was found in the Linux kernel’s sysctl subsystem in reading the /proc/sys/kernel/rhfeatures file. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality...

kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c

A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system...

The vulnerability of the AppArmor component of the runc container runtime tool, related to authentication mechanisms that are flawed, allows a malicious actor to mount a malicious Docker image in the /proc directory.

The vulnerability of the AppArmor component in the runc container isolation tool is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a remote attacker to mount a malicious Docker image as a file in the /proc directory...