Операционные системы: уязвимости стека · Страница 171

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

• Обновитесь до 4.0.12-1
• Обновитесь до 4.0.9

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985). Changes for guava: - Adapt the generated OSGi data to reality - Upgrade to guava 33.7.2 * Changes of 33.7.2 + collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (bsc#1284985, CVE-2026-102554) * Changes of 33.7.1 + removes the Multi-Release line from our jar manifest, fixing an iss

• Обновитесь до 33.7.2-160000.1.1

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

rust-sudo-rs vulnerability

USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.

• Обновитесь до 0.2.14-1ubuntu4.1

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

• Обновитесь до 4.2.1

Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.

Security update for python-WebOb

This update for python-WebOb fixes the following issues: - CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft (bsc#1275917).

• Обновитесь до 1.7.4-150000.3.9.1

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3g_ntfsprogs fixes the following issues: - Denial-of-service in ntfs_inode_attach_all_extents() (bsc#1281758). - Heap buffer overflow in ntfs_acl_owner() (bsc#1281756). - Heap buffer overflow in ntfs_check_restart_area() (bsc#1281759). - Heap buffer overflow in ntfs_ea_check_wsldev() (bsc#1281760). - Heap buffer overflow in ntfs_external_attr_find() (bsc#1281761). - Heap buffer overflow in ntfs_same_sid() (bsc#1281757). - Heap data corruption in ntfs_mapping_pairs_decompress_i() (bsc#1281762). - Heap out of bounds read/write in ntfs_ie_add_vcn() (bsc#1281763).

• Обновитесь до 2022.5.17-150000.3.30.1

Security update for libXpm

This update for libXpm fixes the following issue: - CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).

• Обновитесь до 3.5.12-150000.3.13.1

Security update for openssl-1_0_0

This update for openssl-1_0_0 fixes the following issues: - CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795). Changes for openssl-1_0_0: - Security fixes in August 2026 release (bsc#1274774)

• Обновитесь до 1.0.2p-3.115.1

Security update for libXpm

This update for libXpm fixes the following issue: - CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).

• Обновитесь до 3.5.11-6.13.1

Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576). - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-

• Обновитесь до 1.37.0-150700.18.24.1