Jason A. Donenfeld

**Name of the Vulnerable Software and Affected Versions** Calibre (affected versions not specified) **Description** A race condition issue was found in Calibre, specifically in the devices/linux mount helper.c file, allowing unprivileged users to mount any device to any location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Calibre (affected versions not specified) **Description** A untrusted search path issue was found in Calibre at devices/linux mount helper.c, allowing unprivileged users to execute any program as root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Calibre (affected versions not specified) **Description** Input validation issues were found in Calibre at devices/linux mount helper.c, which can lead to argument injection and elevation of privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.7.7 **Description** An issue was discovered in the Linux kernel, specifically in drivers/acpi/acpi configfs.c, where injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions. **Recommendations** For Linux kernel versions prior to 5.7.7, update to version 5.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to configfs to minimize the risk of exploitation. Avoid using malicious ACPI tables via configfs until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Viscosity version 1.4.1 **Description** A Privilege Escalation issue exists due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code. **Recommendations** For Viscosity version 1.4.1, consider restricting access to the ViscosityHelper binary until a patch is available. As a temporary workaround, disabling the setuid-set functionality for the ViscosityHelper binary may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 0.9.2.5 **Description** The issue allows remote attackers to predict the values of hashes due to insecure hash key generation. **Recommendations** For versions prior to 0.9.2.5, update to version 0.9.2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 0.9.2.5 **Description** The issue allows remote attackers to download sensitive cached database information via their hash keys. **Recommendations** For versions prior to 0.9.2.5, update to version 0.9.2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 0.9.2.5 **Description** The issue allows remote attackers to retrieve password hash information due to insecure storage of database cache files. **Recommendations** For versions prior to 0.9.2.5, update to version 0.9.2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux versions prior to 5.3.4 **Description** A local attacker can exploit a reference count usage error in the `fib6 rule suppress()` function in the fib6 suppression feature of the `net/ipv6/fib6 rules.c` file, when handling the `FIB LOOKUP NOREF` flag, to corrupt memory. This issue is related to the lack of resource release after its expiration, which can allow an attacker to cause memory damage. **Recommendations** For versions prior to 5.3.4, update to version 5.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fib6 rule suppress()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.4 **Description** An issue in the Linux kernel's drivers/firmware/efi/efi.c allows attackers to bypass lockdown or secure boot restrictions due to incorrect access permissions for the `efivar ssdt` ACPI variable. This could be exploited to circumvent security features. **Recommendations** For Linux kernel versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `efivar ssdt` ACPI variable to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: QtPass versions prior to 1.2.1 Description: A issue was found in QtPass where the built-in password generator produces possibly predictable and enumerable passwords when using the QtPass GUI. Recommendations: For QtPass versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the built-in password generator in the QtPass GUI until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Rxvt version 2.7.10 **Description** The issue allows for a denial of service attack by passing the value -2^31 inside a terminal escape code. This results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read. **Recommendations** For Rxvt version 2.7.10, consider restricting the use of terminal escape codes until a patch is available to prevent the denial of service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 4.0.5 **Description** The issue allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service via a crafted packet. This is due to the OZWPAN driver relying on an untrusted length field during packet parsing, leading to an out-of-bounds read and potential system crash. **Recommendations** For Linux kernel versions through 4.0.5, update to a version later than 4.0.5 to resolve the issue. As a temporary workaround, consider restricting access to the OZWPAN driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gentoo Portage version 2.1.12 **Description** The issue concerns the urlopen function in Gentoo Portage, which fails to verify X.509 certificates from SSL servers when using HTTPS. This allows man-in-the-middle attackers to spoof servers and modify binary package lists by using a crafted certificate. **Recommendations** For Gentoo Portage version 2.1.12, consider disabling the urlopen function until a patch is available, or apply configuration changes to enforce certificate verification for HTTPS connections.

**Name of the Vulnerable Software and Affected Versions** OpenSMTPD versions prior to 5.3.2 **Description** The issue allows remote attackers to cause a denial of service by keeping a connection open, due to improper handling of SSL sessions. **Recommendations** For versions prior to 5.3.2, update to version 5.3.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** cgit versions prior to 0.9.2 **Description** A directory traversal issue exists in the cgit parse readme function, allowing remote attackers to read arbitrary files. This occurs when a readme file is set to a filesystem path and the url parameter contains a .. (dot dot) sequence. **Recommendations** For versions prior to 0.9.2, update to version 0.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the cgit parse readme function until a patch is available. Avoid using filesystem paths for readme files in the affected versions.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** A race condition issue exists in the runScript function, allowing local users to gain privileges by replacing a script file. **Recommendations** For versions 3.3beta20 and earlier, update to a version later than 3.3beta20 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** The issue allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event. **Recommendations** For versions 3.3beta20 and earlier, consider restricting the execution of scripts from OpenVPN configuration files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** The issue allows local users to gain privileges. This is due to the software relying on argv[0] to determine the name of an appropriate kernel module pathname or executable file pathname, which can be exploited via an execl system call. **Recommendations** For versions 3.3beta20 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** The issue allows local users to bypass intended access restrictions and gain privileges. This can be achieved via a user-mountable image or a network share, by exploiting the fact that Tunnelblick relies on a test for specific ownership and permissions to determine whether a program can be safely executed. **Recommendations** For Tunnelblick versions 3.3beta20 and earlier, consider restricting access to user-mountable images and network shares to minimize the risk of exploitation. Additionally, review and enforce strict ownership and permissions settings to prevent unauthorized execution of programs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.