SUSE Linux Enterprise Server 15

nfs-utils: root-owned files stored in insecure /var/lib/nfs directory

wicked: Use-after-free when receiving invalid DHCP6 client options

wicked: Use-after-free when receiving invalid DHCP6 IA_PD option

osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues

pcp: Local privilege escalation from user pcp to root

pcp: Local privilege escalation from user pcp to root through migrate_tempdirs

Local privilege escalation from user salt to root

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

crypto: algif_aead - Revert to operating out-of-place

User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2

rmt-server-pubcloud allows to escalate from user _rmt to root

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.

Migrations requests can cause DoS on rmt

openldap uses fixed paths in /tmp

clone-master-clean-up: dangerous file system operations

There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead to denial of service.

Deprecated functionality in autoyast2 automatically imports gpg keys without checking them

mysql-systemd-helper allows setting 640 permissions of arbitrary files

In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

grub2-once uses fixed file name in /var/tmp

Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-tools

permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim