Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Affected: npm: yarn

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

openstack-mistral: information disclosure in mistral log waitress: HTTP request smuggling through LF vs CRLF handling waitress: HTTP request smuggling through invalid Transfer-Encoding waitress: HTTP Request Smuggling through Invalid whitespace characters in headers python-pillow: uncontrolled resource consumption in FpxImagePlugin.py PyYAML: command execution through python/object/apply constructor in FullLoader python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images yarn: Arbitrary filesystem write via tar expansion python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode() python-pillow: multiple out-of-bounds reads via a crafted JP2 file python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: node-yarnpkg

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.