CVE Vulnerability Catalog

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original setuid/setgid bits.

In less through version 653, improper quoting in filename.c allows OS command execution via a newline character in a file name. Exploitation typically requires attacker-controlled file names, such as from untrusted archives.

The sort utility in uutils coreutils crashes (panics) when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and uses expect(), causing an immediate crash upon encountering valid but non-UTF-8 paths.

A vulnerability in the tail utility of uutils coreutils allows exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting its contents.

A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories.

An improper access control vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware allows a malicious hypervisor to bypass RMP protections, potentially compromising SEV-SNP guest memory integrity.

A vulnerability in CPython (from version 0 to 3.6.13, 3.7.0-3.7.10, 3.8.0-3.8.8, 3.9.0-3.9.2) allows Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs functions. An attacker can use a technique called 'parameter cloaking' to manipulate query parameters.

An issue was discovered in py-lmdb 0.97 where mdb_page_touch does not properly set up mc->mc_pg[mc->top] for certain mp_flags values, leading to an invalid write operation. The vulnerability can be triggered by supplying a crafted data.mdb file.

Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware causes insufficient or incomplete data removal in a hardware component, resulting in incomplete IOMMU flushing. This can potentially lead to a loss of confidentiality and integrity in guest memory.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

A use-after-free vulnerability in SEV firmware allows a malicious hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent, potentially leading to loss of integrity.

A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.

In the Linux kernel, a vulnerability in the mshv_vtl component occurs when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, where the computed vmemmap_shift may exceed MAX_FOLIO_ORDER, leading to incorrect behavior.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.

A vulnerability in the Linux kernel's FUSE filesystem causes a hang during sync initialization when the FUSE server exits (e.g., due to error or crash) while processing the FUSE_INIT request. The issue stems from the lack of abort on a fatal signal, blocking filesystem creation.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware allows a privileged attacker to modify the lock bit, potentially downgrading the firmware and compromising system integrity.

A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.