https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 16:51:06 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-35362 <p>The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.</p> <p>The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-35362 https://vulnerability.circl.lu/vuln/ghsa-ggc5-46rg-mr4v <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: coreutils</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w6xc-g9qj-vp32. This link is maintained to preserve external references.</p> <p>### Original Description The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: coreutils</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w6xc-g9qj-vp32. This link is maintained to preserve external references.</p> <p>### Original Description The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.</p> https://vulnerability.circl.lu/vuln/ghsa-ggc5-46rg-mr4v https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-35362 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils</p> <p>The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils</p> <p>The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-35362