Threats Tagged 'cwe-277'

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.

Bulletin ID: AWS-2025-018 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/08/14 09:15 PM PDT Description: Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. Amazon ECS container agent provides an introspection API that provides information about the overall state of the Amazon ECS agent and the container instances. We identified CVE-2025-9039, an issue in the Amazon ECS agent. Under certain conditions, this issue could allow an introspection server to be accessed off-host by another instance if the instances are in the same security group or if their security groups allow inbound connections to the introspection server port. This issue does not affect instances where the option to allow off-host access to the introspection server is set to "false". Affected versions: ECS Agent versions 0.0.3 through 1.97.0

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.

LowVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-65111#cwe-277

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-64185#cwe-277

IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-36104#cwe-277

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access to all users. Attackers with filesystem access can exploit a race condition to overwrite the script before execution, enabling arbitrary code execution under the victim's privileges. This risk is significant in shared environments, potentially leading to full system compromise. Even with non-static directory names, attackers can monitor parent directories for file creation events. The brief window between script creation (with insecure permissions) and execution allows rapid overwrites. Directory names can also be inferred via timestamps or logs, and automation enables exploitation even with semi-randomized paths by acting within milliseconds of detection. This issue has been patched in version 25.3.1. A workaround involves restricting conda_build.sh permissions from 0o766 to 0o700 (owner-only read/write/execute). Additionally, use atomic file creation (write to a temporary randomized filename and rename atomically) to minimize the race condition window.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-32797#cwe-277

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-3473#cwe-277

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2018-25111#cwe-277

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * python3-pulpcore/python39-pulpcore: RBAC permissions incorrectly assigned in tasks that create objects (CVE-2024-7143) * python3-urllib3/python39-urllib3: urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) * receptor: golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) * receptor: golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes for automation controller: * Updated fallback to use RHSM subscription credential for shipping analytics data if analytics gathering is enabled (AAP-30228) * Upgraded 'channels-redis' library to fix Redis connection leak (AAP-30124) * automation-controller has been updated to 4.5.11 Additional fixes: * python3/python39-django has been updated to 4.2.16 * python3/python39-pulpcore has been updated to 3.28.32 * python3/python39-urllib3 has been updated to 1.26.20 * receptor has been updated to 1.4.8-1.1