Monthly
SoftReadWriteLock in the Python filelock package (4.0.0 through 4.2.0) refreshes holder records by pathname without verifying that the name still resolves to the file it originally created, so a local user who can rename entries in the lock directory can substitute a named pipe (FIFO) and stall the lock, or - where the hard-link policy is permissive - link a file the victim can reach and cause the lock holder to write through it. Exploitation requires an authenticated local account sharing the lock directory (CVSS PR:L, AV:L), so this is a locally-exploitable, medium-severity issue (CVSS 6.1, integrity low, availability high) rather than a remote one; no public exploit code was identified at time of analysis and the flaw is fixed in filelock 4.2.1.
Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) where the snapshot functionality allows a local attacker with user-level privileges to write arbitrary files via hard link exploitation of a root-owned process. An attacker can leverage this to escalate privileges from a normal user to root, potentially achieving full system compromise. The vulnerability has a CVSS score of 7.8 (high severity) and requires local access with low complexity.
Privilege escalation vulnerability in Parallels Desktop for Mac 20.1.1 that allows a local attacker with user-level privileges to gain root-level code execution through a hard link attack during virtual machine archive restoration. The prl_vmarchiver tool operates with root privileges during decompression and file restoration, enabling an attacker to redirect writes to arbitrary system files. This vulnerability has a CVSS score of 7.8 (High) with low attack complexity, making it a practical privilege escalation vector for local users on affected systems.
SoftReadWriteLock in the Python filelock package (4.0.0 through 4.2.0) refreshes holder records by pathname without verifying that the name still resolves to the file it originally created, so a local user who can rename entries in the lock directory can substitute a named pipe (FIFO) and stall the lock, or - where the hard-link policy is permissive - link a file the victim can reach and cause the lock holder to write through it. Exploitation requires an authenticated local account sharing the lock directory (CVSS PR:L, AV:L), so this is a locally-exploitable, medium-severity issue (CVSS 6.1, integrity low, availability high) rather than a remote one; no public exploit code was identified at time of analysis and the flaw is fixed in filelock 4.2.1.
Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) where the snapshot functionality allows a local attacker with user-level privileges to write arbitrary files via hard link exploitation of a root-owned process. An attacker can leverage this to escalate privileges from a normal user to root, potentially achieving full system compromise. The vulnerability has a CVSS score of 7.8 (high severity) and requires local access with low complexity.
Privilege escalation vulnerability in Parallels Desktop for Mac 20.1.1 that allows a local attacker with user-level privileges to gain root-level code execution through a hard link attack during virtual machine archive restoration. The prl_vmarchiver tool operates with root privileges during decompression and file restoration, enabling an attacker to redirect writes to arbitrary system files. This vulnerability has a CVSS score of 7.8 (High) with low attack complexity, making it a practical privilege escalation vector for local users on affected systems.