https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:19:14 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-12851 bdu:2026-12851 https://cve.radiocsirt.org/vuln/bdu:2026-12851 https://cve.radiocsirt.org/vuln/bell-cve-2026-41054 <p><strong>Affected:</strong> Alpaquita:23: haveged, Alpaquita:25: haveged, Alpaquita:stream: haveged</p> <p><strong>Affected:</strong> Alpaquita:23: haveged, Alpaquita:25: haveged, Alpaquita:stream: haveged</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-41054 https://cve.radiocsirt.org/vuln/euvd-2026-324836 EUVD-2026-324836 https://cve.radiocsirt.org/vuln/euvd-2026-324836 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41054 <p>In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.</p> <p>In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41054 https://cve.radiocsirt.org/vuln/ghsa-c5g3-m8p9-m3gh <p>In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.</p> <p>In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.</p> https://cve.radiocsirt.org/vuln/ghsa-c5g3-m8p9-m3gh https://cve.radiocsirt.org/vuln/msrc_cve-2026-41054 msrc_CVE-2026-41054 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41054 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10833-1 <p>haveged-1.9.21-1.1 on GA media</p> <p>haveged-1.9.21-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10833-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41054 <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: haveged, Ubuntu:Pro:24.04:LTS: haveged, Ubuntu:25.10: haveged, Ubuntu:26.04:LTS: haveged</p> <p>In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.</p> <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: haveged, Ubuntu:Pro:24.04:LTS: haveged, Ubuntu:25.10: haveged, Ubuntu:26.04:LTS: haveged</p> <p>In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41054