A symlink following vulnerability was found in the ABRT post-create event handler scripts in /etc/libreport/events.d/abrtevent.conf. Event scripts write output files using shell redirections (e.g., "printf ... > $DUMPDIR/varlogmessages") which use open() with OWRONLY|OCREAT|OTRUNC without the ONOFOLLOW flag. If the target file is replaced with a symlink, the shell process (running as root in the abrthandleeventt SELinux domain, which is effectively unconfined) follows the symlink and writes content to the symlink target. In contrast, ddsavetext (used by SetElement) correctly uses ONOFOLLOW. An attacker who has gained filesystem control of the dump directory can replace output files with symlinks pointing to sensitive system files such as /var/spool/cron/root.

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

Chromium: CVE-2024-6293 Use after free in Dawn

Command injection via array-ish $command parameter of procopen() (bypass CVE-2024-1874 fix)

Chromium: CVE-2024-5499 Out of bounds write in Streams API

Chromium: CVE-2024-5497 Out of bounds memory access in Keyboard Inputs

Chromium: CVE-2024-5493 Heap buffer overflow in WebRTC

Chromium: CVE-2024-5834 Inappropriate implementation in Dawn

Chromium: CVE-2024-5830 Type Confusion in V8

Chromium: CVE-2024-5833 Type Confusion in V8

Chromium: CVE-2024-5838 Type Confusion in V8

Chromium: CVE-2024-6292 Use after free in Dawn

Chromium: CVE-2024-5837 Type Confusion in V8

Chromium: CVE-2024-6290 Use after free in Dawn

Chromium: CVE-2024-5158 Type Confusion in V8

Chromium: CVE-2024-5835 Heap buffer overflow in Tab Groups

Chromium: CVE-2024-5836 Inappropriate Implementation in DevTools

btrfs: make sure that WRITTEN is set on all metadata blocks

Chromium: CVE-2024-5847 Use after free in PDFium

Chromium: CVE-2024-5846 Use after free in PDFium

Chromium: CVE-2024-4761 Out of bounds write in V8

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

An attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation.

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the objects/ directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's objects/ directory. When cloning a repository over the filesystem (without explicitly specifying the file:// protocol or --no-local), the optimizations for local cloning will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with git clone --no-local to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a .zip file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the lib/plugin.php file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the apipluginhook() function in the lib/plugin.php file, which reads the pluginhooks and pluginconfig tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in automationgetnewgraphssql function of apiautomation.php allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In apiautomation.php line 856, the getrequestvar('filter') is being concatenated into the SQL statement without any sanitization. In apiautomation.php line 717, The filter of 'filter' is FILTERDEFAULT, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

In the Linux kernel, the following vulnerability has been resolved:

firewire: nosy: ensure userlength is taken into account when fetching packet contents

Ensure that packetbufferget respects the userlength provided. If the length of the head packet exceeds the userlength, packetbufferget will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows.

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: once more fix the call oder in amdgputtmmove() v2

This reverts drm/amdgpu: fix ftrace event amdgpubomove always move on same heap. The basic problem here is that after the move the old location is simply not available any more.

Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well.

Also rework the statistic handling so that we don't update the eviction counter before the move.

v2: add missing NULL check

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix use-after-free bugs caused by scosocktimeout

The Linux kernel CVE team has assigned CVE-2024-27398 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051355-CVE-2024-27398-08ef@gregkh/T