ALT-BU-2025-15489-4
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2025-12-25
BDU:2025-11660
Уязвимость виртуальной обучающей среды Moodle, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю получить провести атаку межсайтового скриптинга (XSS)
BDU:2025-15611
Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной авторизацией, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2025-15612
Уязвимость виртуальной обучающей среды Moodle, связанная с раскрытием информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2026-00821
Уязвимость виртуальной обучающей среды Moodle, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код и скомпрометировать систему
Modified: 2026-04-15
CVE-2025-54869
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service (DoS) vulnerability. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability. This issue is fixed in version 2.6.3.
Modified: 2025-11-14
CVE-2025-62393
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
Modified: 2025-11-14
CVE-2025-62394
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.
Modified: 2025-11-14
CVE-2025-62395
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.
Modified: 2025-11-14
CVE-2025-62396
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
Modified: 2025-11-14
CVE-2025-62397
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Modified: 2025-11-14
CVE-2025-62398
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
Modified: 2025-11-14
CVE-2025-62399
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
Modified: 2025-11-14
CVE-2025-62400
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
Modified: 2025-11-14
CVE-2025-62401
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
Modified: 2026-03-05
CVE-2025-67847
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.
Modified: 2026-02-11
CVE-2025-67848
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
Modified: 2026-02-11
CVE-2025-67849
A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
Modified: 2026-02-11
CVE-2025-67850
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
Modified: 2026-02-11
CVE-2025-67851
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.
Modified: 2026-02-11
CVE-2025-67852
A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. This occurs due to insufficient validation of redirect parameters, which could lead to phishing attacks or information disclosure.
Modified: 2026-02-11
CVE-2025-67853
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.
Modified: 2026-02-11
CVE-2025-67855
A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerability arises from insufficient sanitization of URL parameters, allowing attackers to inject malicious scripts through specially crafted links. Successful exploitation could lead to information disclosure or arbitrary client-side script execution within the user's browser.
Modified: 2026-02-26
CVE-2025-67856
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not entitled to, potentially leading to privilege escalation or unauthorized access to certain features.
Modified: 2026-02-11
CVE-2025-67857
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
Modified: 2025-10-24
GHSA-25wf-7x6c-wmpf
Moodle does not properly enforce MFA
- https://nvd.nist.gov/vuln/detail/CVE-2025-62398
- https://github.com/moodle/moodle/commit/67005f8b2098096f4c7ca4f78ab9ce69415d703b
- https://github.com/moodle/moodle/commit/a2078f781ae065ca1f781bd159c7615c84afcaa5
- https://access.redhat.com/security/cve/CVE-2025-62398
- https://bugzilla.redhat.com/show_bug.cgi?id=2404431
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470387
Modified: 2025-10-24
GHSA-422v-w6c5-vq42
Moodle exposed the names of hidden groups to users
- https://nvd.nist.gov/vuln/detail/CVE-2025-62400
- https://github.com/moodle/moodle/commit/0c70d67059658879a71152ea075c74154a627d05
- https://access.redhat.com/security/cve/CVE-2025-62400
- https://bugzilla.redhat.com/show_bug.cgi?id=2404433
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470389
Modified: 2026-02-03
GHSA-5cx4-w4fh-fr57
Moodle Affected by Improper Restriction of Excessive Authentication Attempts
Modified: 2026-02-03
GHSA-6mmv-f6c6-v6q8
Moodle vulnerable to Cross-site Scripting
- https://nvd.nist.gov/vuln/detail/CVE-2025-67850
- https://github.com/moodle/moodle/commit/c85f153068a717a3b28bc122e75154bac99e67e1
- https://access.redhat.com/security/cve/CVE-2025-67850
- https://bugzilla.redhat.com/show_bug.cgi?id=2423838
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471300
Modified: 2025-10-24
GHSA-8fcv-4qp9-pg32
Moodle sends quiz-related messages to inactive/suspended users
- https://nvd.nist.gov/vuln/detail/CVE-2025-62394
- https://github.com/moodle/moodle/commit/022bfbfb564d8f3866a43d26eed215213bbdd28a
- https://access.redhat.com/security/cve/CVE-2025-62394
- https://bugzilla.redhat.com/show_bug.cgi?id=2404427
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470383
Modified: 2026-02-03
GHSA-8jrv-wx83-w3xj
Moodle Inserts Sensitive Information Into Sent Data
- https://nvd.nist.gov/vuln/detail/CVE-2025-67857
- https://github.com/moodle/moodle/commit/ac30e7e19357f696979b7ffd760a7131b6ad88f6
- https://github.com/moodle/moodle/commit/c6cb8d971257c04a12a2c5d8510a89cb906f46f0
- https://access.redhat.com/security/cve/CVE-2025-67857
- https://bugzilla.redhat.com/show_bug.cgi?id=2423868
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471307
Modified: 2025-10-24
GHSA-c5cj-xp43-qcc3
Moodle's error handling leads to sensitive information disclosure
- https://nvd.nist.gov/vuln/detail/CVE-2025-62396
- https://github.com/moodle/moodle/commit/5d4910509eeaac8403d18ec8f259e29d2f11527e
- https://github.com/moodle/moodle/commit/5e7d5abc483d0511ebfc2042075eabcc392ff4ce
- https://access.redhat.com/security/cve/CVE-2025-62396
- https://bugzilla.redhat.com/show_bug.cgi?id=2404429
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470385
Modified: 2026-02-03
GHSA-hcm6-q6pc-xfhm
Moodle has an authorization logic flaw
- https://nvd.nist.gov/vuln/detail/CVE-2025-67856
- https://github.com/moodle/moodle/commit/0d48779e61bcacbabbcb82858a037b567351fce0
- https://access.redhat.com/security/cve/CVE-2025-67856
- https://bugzilla.redhat.com/show_bug.cgi?id=2423864
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471306
Modified: 2026-02-03
GHSA-j5jv-w5cw-j9ff
Moodle authentication bypass vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2025-67848
- https://github.com/moodle/moodle/commit/62f372e9d861d16df702d3c7726905fa2730e3d8
- https://github.com/moodle/moodle/commit/c2705e2c18962fec4f21b9c34ed386be2a379663
- https://access.redhat.com/security/cve/CVE-2025-67848
- https://bugzilla.redhat.com/show_bug.cgi?id=2423831
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471298
Modified: 2025-08-06
GHSA-jxhh-4648-vpp3
FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service
Modified: 2025-10-24
GHSA-m58f-9pvv-8mp2
Moodle vulnerable to brute-force password guesses
- https://nvd.nist.gov/vuln/detail/CVE-2025-62399
- https://github.com/moodle/moodle/commit/e4d02567c922c537086de9f59f063ca073552a3a
- https://access.redhat.com/security/cve/CVE-2025-62399
- https://bugzilla.redhat.com/show_bug.cgi?id=2404432
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470388
Modified: 2026-02-03
GHSA-mhf6-pp52-8wqj
Moodle Cross-site Scripting (XSS) vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2025-67849
- https://github.com/moodle/moodle/commit/a3063dcaa44dbe66e60a37cadb33bfadfe4feb03
- https://access.redhat.com/security/cve/CVE-2025-67849
- https://bugzilla.redhat.com/show_bug.cgi?id=2423835
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471299
Modified: 2026-02-03
GHSA-qfh6-h7j6-fvjv
Moodle formula injection vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2025-67851
- https://github.com/moodle/moodle/commit/29820c5ff4ef381c7a743091ec5c68ac82903b22
- https://github.com/moodle/moodle/commit/aa66bacd0783cbc33528fba9c2adca1f685a59bd
- https://github.com/moodle/moodle/commit/dc57ccc491a2a04032445a3ee92fd0d335ebd746
- https://access.redhat.com/security/cve/CVE-2025-67851
- https://bugzilla.redhat.com/show_bug.cgi?id=2423841
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471301
Modified: 2026-02-03
GHSA-qv78-6gpp-hm68
Moodle Open Redirect vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2025-67852
- https://github.com/moodle/moodle/commit/fa1624c8c9e3efa917f0e9d2666bb59d8be2a975
- https://access.redhat.com/security/cve/CVE-2025-67852
- https://bugzilla.redhat.com/show_bug.cgi?id=2423844
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471302
Modified: 2025-10-24
GHSA-rjcm-7v2p-9265
Moodle course access permissions are not properly checked in course_output_fragment_course_overview
- https://nvd.nist.gov/vuln/detail/CVE-2025-62393
- https://github.com/moodle/moodle/commit/fc69b4744ba0132cc3093fd81940be15bc293835
- https://access.redhat.com/security/cve/CVE-2025-62393
- https://bugzilla.redhat.com/show_bug.cgi?id=2404426
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470381
Modified: 2026-02-03
GHSA-vwhw-vp9v-q9c9
Moodle vulnerable to Cross-site Scripting
- https://nvd.nist.gov/vuln/detail/CVE-2025-67855
- https://github.com/moodle/moodle/commit/0c146aa2612fb6d0544f200a018cb42da75db713
- https://access.redhat.com/security/cve/CVE-2025-67855
- https://bugzilla.redhat.com/show_bug.cgi?id=2423861
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=471305
Modified: 2025-10-24
GHSA-w29j-8phw-ffjf
Moodle has a time restriction bypass
- https://nvd.nist.gov/vuln/detail/CVE-2025-62401
- https://github.com/moodle/moodle/commit/78a3fe6c618676dfc53ea538abbfe35e60674eeb
- https://access.redhat.com/security/cve/CVE-2025-62401
- https://bugzilla.redhat.com/show_bug.cgi?id=2404434
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=470390
Modified: 2026-01-26
GHSA-xvmh-25jw-gmmm
Moodle affected by a code injection vulnerability
Closed bugs
Отсутствует конфигурационная директория /etc/keyd после установки
Closed vulnerabilities
Modified: 2026-04-27
BDU:2025-14040
Уязвимость инструмента для запуска изолированных контейнеров runc, связанная с состоянием гонки, разрешающим отслеживание ссылок, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2025-12-03
CVE-2025-52881
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
- http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
- https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
- https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
- https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
- https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
- https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
- https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
- https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
- https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
- https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
- https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
- https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
- https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
- https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
- https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
Modified: 2025-11-18
GHSA-cgrx-mc8f-2prm
runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects
- https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
- https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://nvd.nist.gov/vuln/detail/CVE-2025-52881
- https://github.com/opencontainers/selinux/pull/237
- https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
- https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
- https://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
- https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
- https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
- https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
- https://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
- https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
- https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
- https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
- https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
- https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
- https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
- https://youtu.be/tGseJW_uBB8
- https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs
- https://youtu.be/y1PaBzxwRWQ
- https://github.com/opencontainers/selinux/releases/tag/v1.13.0
- https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
- https://github.com/opencontainers/runc
- http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
Closed vulnerabilities
Modified: 2026-04-27
BDU:2025-14040
Уязвимость инструмента для запуска изолированных контейнеров runc, связанная с состоянием гонки, разрешающим отслеживание ссылок, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2025-12-03
CVE-2025-52881
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
- http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
- https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
- https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
- https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
- https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
- https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
- https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
- https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
- https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
- https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
- https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
- https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
- https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
- https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
- https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
Modified: 2025-11-18
GHSA-cgrx-mc8f-2prm
runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects
- https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
- https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://nvd.nist.gov/vuln/detail/CVE-2025-52881
- https://github.com/opencontainers/selinux/pull/237
- https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
- https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
- https://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
- https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
- https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
- https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
- https://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
- https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
- https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
- https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
- https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
- https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
- https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
- https://youtu.be/tGseJW_uBB8
- https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs
- https://youtu.be/y1PaBzxwRWQ
- https://github.com/opencontainers/selinux/releases/tag/v1.13.0
- https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
- https://github.com/opencontainers/runc
- http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
Closed bugs
Аварийная остановка при создании бага в GitHub/GitLab/Gitea с помощью gcli
Closed bugs
Ошибка при импорте PDF
