CVE Vulnerability Catalog

A vulnerability in the rm utility of uutils coreutils allows bypassing the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers, allowing an attacker or accidental user to bypass the safeguard via a symbolic link resolving to the root directory.

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

The comm utility in uutils coreutils reads from non-regular file inputs before performing comparison. The are_files_identical function opens and reads both inputs without first verifying they are regular files, causing silent data loss for FIFOs or pipes and potential hangs on infinite streams like /dev/zero.

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

A flaw in ChownExecutor in uutils coreutils chown and chgrp returns an incorrect exit code during recursive operations. The exit code depends only on the last processed file, masking permission errors on earlier files if the last succeeds.

The recursive mode (-R) of chmod in uutils coreutils mishandles exit codes with multiple files. The return value depends only on the last file, so errors like 'Operation not permitted' on earlier files are masked by the last file's success.

GitLab remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1. An authenticated user could cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.

A vulnerability in GitLab CE/EE is caused by insufficient resource allocation limits in the GraphQL API. An authenticated user could cause denial of service by overwhelming system resources under certain conditions.

A vulnerability in GitLab CE/EE allows an authenticated user to cause denial of service by sending crafted requests to a discussions endpoint, exhausting server resources. The issue affects versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada theme. Allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. Affects versions before 7.13.2.

A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).

A memory corruption flaw was found in GNU Emacs that occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS (Cascading Style Sheets) data. A local user could exploit this by convincing a victim to open a malicious SVG file, potentially leading to denial of service (DoS) or information disclosure.

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption if using the LMDB backend.

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service when a PowerDNS secondary server forwards a DNS update request to it.

Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

A rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value, triggering an out-of-bounds write that leads to denial of service.

A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. The vulnerability affects processing of cached responses in the context of custom Lua code.

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.

An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.