CVE Vulnerability Catalog

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.

In the Linux kernel, in the KVM subsystem for s390 PCI handling, a bug was found: when a guest registers IRQs without a summary bit, the associated GAITE entry stores an incorrect value (physical address instead of zero) in the guest AISB location. The fix ensures zero is stored there.

In the Linux kernel, in the s390/zcrypt subsystem, a buffer over-read vulnerability was found in cca_cipher2protkey. User-controlled length fields in CCA token structures were used without proper validation against buffer size and minimum token size, potentially leading to out-of-bounds reads or buffer underruns, causing kernel crashes or memory exposure.

In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA AES cipher key requests. cca_cipher2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.

In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA ECC private key requests. cca_ecc2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.

Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information.

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.

An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

The BT122 module stops advertising after receiving a plaintext 'pause encryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below.

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges.

During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.