emanonchen/unfixed-security-bugs

A list of publicly known but unfixed security bugs

A list of publicly known but unfixed security bugs

Please submit a pull request if you have corrections or know about any other unfixed security bugs.

tar

• rmt filename support makes tar vulnerable to "phishing" attacks

Chrome

• CSS mix-blend-mode is bad for your browsing history (demo)

Pretty much every terminal emulator

• Multi-line pastes from an untrusted source (e.g. browser) can automatically execute something you did not intend to copy

sudo

• sudo TTY tickets (generally enabled by default) allow any subprocess to do a passwordless sudo within the timeout period, not just commands you've typed into the shell.

VirtualBox

• Unlike VMware Workstation, VirtualBox clipboard sharing gives guests continuous access to the clipboard, instead of just when the VM is focused.

Xorg

• Any program connected to the server can sniff another program's keystrokes. Solved in Wayland.

Node

• node climbs up to look for node_modules in directories that can be written to by other users

Erlang/OTP

• You can crash a distributed Erlang node by making ~1M connections with an invalid security cookie

• Check for null bytes in binaries / strings when opening files

• Stored XSS vulnerability in mod_dir

Twisted

• Credentials materials are compared unsafely throughout Twisted, still open due to the difficulty of measuring whether the constant-time compare function actually fixes anything.

• twisted.web has no protection against HTTP response-splitting attacks

• twisted.web server has no way to limit size of request body

alchemist-server

• Server executes arbitrary code from remote machines

alchemist.vim

• Bundled alchemist-server is vulnerable to remote code execution

WeeChat

• WeeChat relays allows clients to execute code on the relay

phantomjs, libqtwebkit4, libqt5webkit5

• These packages exist in a state of permanent insecurity because they don't keep up with the ~6-week browser update cycle. (e.g. take any one of the many WebKit security bugs fixed after the last release of these packages, which could be a ~year old.)

Windows 7 through 10

• Various methods of automatically bypassing UAC (see "Unfixed methods in upcoming Windows 10 RS2 release")