Luciano Bello

**Name of the Vulnerable Software and Affected Versions** Tor version 0.2.9.11-1~deb9u1 **Description** The issue is related to the debian/tor.init script in the Tor package, which was designed to execute aa-exec from the standard system pathname if the apparmor package is installed. However, the script implements this incorrectly, assuming the specific pathname would remain the same forever. This allows attackers to bypass intended AppArmor restrictions by leveraging the silent loss of this protection mechanism. The issue does not affect systems where Tor startup relies on a systemd unit file, such as default Debian stretch installations. **Recommendations** For Tor version 0.2.9.11-1~deb9u1, consider disabling the execution of aa-exec from the standard system pathname until a corrected version of the tor.init script is available. As a temporary workaround, restrict access to the vulnerable script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** unADF (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow in the extractTree function, which allows remote attackers to execute arbitrary code via a long pathname. This can potentially lead to the execution of malicious code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** unADF (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file, specifically through the extractTree function in unADF. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** davfs2 versions 1.4.6 through 1.4.7 **Description** The issue allows local users to gain privileges via unknown attack vectors in files such as kernel interface.c and mount davfs.c, related to the `system` function. Multiple vulnerabilities in the davfs2 package may lead to breaches of confidentiality, integrity, and availability of protected information, potentially exploitable by local attackers. **Recommendations** For davfs2 versions 1.4.6 and 1.4.7, consider restricting access to the `system` function until a patch is available. As a temporary workaround, consider disabling the functions related to kernel interface.c and mount davfs.c to minimize the risk of exploitation.