Monthly
Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.
Complete persistent denial of service in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated, low-privilege network attackers to crash the evo-aftmand service with no automatic recovery. The vulnerability triggers when PCEP-provisioned colored SRTE policy tunnels with 32-bit ASN values (greater than 65,535) in the Originator ASN field are monitored via gRPC, causing permanent forwarding plane failure until manual system restart. Affects multiple versions through 25.2 release train. No public exploit identified at time of analysis.
A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.
Complete persistent denial of service in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated, low-privilege network attackers to crash the evo-aftmand service with no automatic recovery. The vulnerability triggers when PCEP-provisioned colored SRTE policy tunnels with 32-bit ASN values (greater than 65,535) in the Originator ASN field are monitored via gRPC, causing permanent forwarding plane failure until manual system restart. Affects multiple versions through 25.2 release train. No public exploit identified at time of analysis.
A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.