Wolfgang Frisch

**Name of the Vulnerable Software and Affected Versions** csync2 versions prior to 2.0+git.1600444747.83b3644-3.1 **Description** When compiled with C99 or later, the software uses insecure temporary directories. This allows for Time-of-Check to Time-of-Use (TOCTOU) attacks, a race condition where a system checks a condition (such as the existence of a file) and then uses the result of that check, but the condition changes between the check and the use. **Recommendations** Update to version 2.0+git.1600444747.83b3644-3.1.

**Name of the Vulnerable Software and Affected Versions** usbmuxd versions prior to 3ded00c9985a5108cfc7591a309f9a23d57a8cba **Description** A Path Traversal vulnerability exists in usbmuxd, potentially allowing local users to gain elevated privileges to the service user level. The issue is due to insufficient sanitization of file paths. **Recommendations** Update usbmuxd to version 3ded00c9985a5108cfc7591a309f9a23d57a8cba or later.

Name of the Vulnerable Software and Affected Versions: OpenVPN 3 Linux versions 20 through 24 Description: The configuration initialization tool in OpenVPN 3 Linux allows a local attacker to use symlinks pointing at an arbitrary directory, which will change the ownership and permissions of that destination directory. Recommendations: For OpenVPN 3 Linux versions 20 through 24, consider restricting the use of the configuration initialization tool until a patch is available to prevent local attackers from exploiting symlinks to alter directory permissions.

**Name of the Vulnerable Software and Affected Versions** NVIDIA GPU Display Driver for Linux (affected versions not specified) **Description** The NVIDIA GPU Display Driver for Linux contains a vulnerability that could allow an attacker unauthorized access to files, potentially leading to limited information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pgAgent versions prior to 4.2.3 **Description** The issue arises when pgAgent executes batch jobs, creating a script in a temporary directory before execution. In affected versions, an insufficiently seeded random number generator is used to generate the directory name. This allows a local attacker to potentially pre-create the directory, preventing pgAgent from executing jobs and disrupting scheduled tasks. **Recommendations** For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory used by pgAgent to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ColPack versions 1.0.10 through 9a7293a **Description** The issue is related to the creation of predictable temporary files in ColPack, located under /tmp with names derived from an unseeded Random Number Generator (RNG). This can lead to overwriting files or making ColPack graphing unavailable to other users. **Recommendations** For ColPack versions 1.0.10 through 9a7293a, consider restricting access to the /tmp directory to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using ColPack graphing functionality that relies on temporary files in /tmp until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** socat versions prior to 1.8.0.2 **Description** The issue is related to the readline.sh file in socat, which relies on the /tmp/$USER/stderr2 file. This can lead to an arbitrary file overwrite via a predictable /tmp directory. **Recommendations** For versions prior to 1.8.0.2, update to version 1.8.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/$USER/stderr2 file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: logiops versions 0.3.4 and earlier Description: The issue allows any unprivileged user to configure the logid daemon via an unrestricted D-Bus service, including setting malicious keyboard macros. This enables privilege escalation with minimal user interaction. Recommendations: For logiops versions 0.3.4 and earlier, consider disabling the unrestricted D-Bus service for the logid daemon until a patch is available to prevent malicious keyboard macro configuration and subsequent privilege escalation. Restrict access to the logid daemon configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** hcode versions 2.1 and earlier **Description** A stack-based buffer overflow was found in the `putSDN()` function of mail.c. **Recommendations** For hcode versions 2.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FDUPES versions prior to 2.2.0 **Description** A TOCTOU race condition in the deletefiles function allows for arbitrary file deletion via a symlink. **Recommendations** For FDUPES versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** check smart versions prior to 6.9.1 **Description** The issue allows unintended drive access by an unprivileged user due to a substring match of a device path, specifically checking for the `/dev/bus` substring and a number, which is an example of an unanchored regular expression. This can lead to unauthorized access. **Recommendations** For versions prior to 6.9.1, update to version 6.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `check smart` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: s390-tools versions prior to 2.1.0-18.29.1 s390-tools versions prior to 2.11.0-9.20.1 Description: A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations. Recommendations: For s390-tools versions prior to 2.1.0-18.29.1, update to version 2.1.0-18.29.1 or later. For s390-tools versions prior to 2.11.0-9.20.1, update to version 2.11.0-9.20.1 or later.

Name of the Vulnerable Software and Affected Versions: Open Build Service versions prior to 2.10.8 Description: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') issue allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. Recommendations: For Open Build Service versions prior to 2.10.8, update to version 2.10.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of markdown in the Open Build Service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.3.11 **Description** The issue is related to a memory leak in the `fsl lpspi probe()` function in the Linux kernel, which can cause a denial of service due to memory consumption. This can be triggered by failures in `pm runtime get sync()`. However, it is noted that third parties dispute the relevance of this issue because an attacker cannot realistically control these failures at probe time. **Recommendations** For Linux kernel versions through 5.3.11, consider updating to a version that fixes this issue. As a temporary workaround, restricting access to the `fsl lpspi probe()` function may help minimize the risk of exploitation. However, since the control of `pm runtime get sync()` failures is not realistic for an attacker, the practical impact of this workaround may be limited. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Build Service versions prior to 0.165.4 **Description** The issue is related to errors in certificate authentication. It may allow a remote attacker to bypass existing security restrictions and implement a "man-in-the-middle" attack. The problem arises because Open Build Service before version 0.165.4 did not validate TLS certificates for HTTPS connections with the osc client binary. **Recommendations** For versions prior to 0.165.4, update to version 0.165.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS connections with the osc client binary until a patch is available. Restrict access to sensitive operations to minimize the risk of exploitation.