Vulnerability intelligence

CVE-2025-5054 is a race condition vulnerability found in Canonical's Apport, a core dump handler in Ubuntu. Specifically, it affects versions up to and including 2.32.0. This vulnerability allows a local attacker to potentially leak sensitive information by exploiting PID reuse, leveraging namespaces. The vulnerability arises because Apport, when handling crashes, attempts to detect if the crashing process was running inside a container *before* performing consistency checks. If an attacker can induce a crash in a privileged process and quickly replace it with another process having the same process ID within a mount and PID namespace, Apport might forward the core dump (containing sensitive information from the original process) into the container. To exploit this, an attacker needs permissions to create user, mount, and PID namespaces with full capabilities.

CVE-2025-4598 is a race condition vulnerability found in systemd-coredump, a core dump handler present in Red Hat Enterprise Linux and Fedora. It allows a local attacker to force a SUID process to crash. The attacker can then replace it with a non-SUID binary, gaining access to the original process's privileged core dump. This access enables the attacker to read sensitive data loaded by the original process, such as contents from `/etc/shadow`, potentially exposing password hashes. The vulnerability arises because the attacker can force the Linux kernel to recycle the process ID (PID) before systemd-coredump analyzes the `/proc/pid/auxv` file, thus winning the race condition and gaining access to the core dump.

CVE-2024-29269 is a command injection vulnerability affecting Telesquare TLR-2005Ksh devices, specifically versions 1.0.0 and 1.1.4. It allows attackers to execute arbitrary system commands remotely by exploiting the "Cmd" parameter. This vulnerability exists because the software constructs commands using external input without properly neutralizing special elements. An attacker can exploit this to gain unauthorized access and control of the affected system.

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.