A list of publicly known but unfixed security bugs

Please submit a pull request if you have corrections or know about any other unfixed security bugs.

tar

• rmt filename support makes tar vulnerable to "phishing" attacks

Chrome

• CSS mix-blend-mode is bad for your browsing history (demo)

Pretty much every terminal emulator

• Multi-line pastes from an untrusted source (e.g. browser) can automatically execute something you did not intend to copy

sudo

• When running sudo -u non-root-user as root, TIOCSTI allows the command in sudo -u non-root-user command to execute anything as root. Can be fixed with Defaults use_pty in sudoers. More notes.

• sudo credential caching (generally enabled by default; disabled with Defaults timestamp_timeout=0) allows any process in a TTY to do a passwordless sudo within the timeout period, not just commands that you've prefixed with sudo in the shell.

VirtualBox

• Unlike VMware Workstation, VirtualBox clipboard sharing gives guests continuous access to the host clipboard, instead of just when the VM is focused.

virt-manager/spice-gtk

• Unlike VMware Workstation, virt-manager/spice-gtk clipboard sharing gives guests continuous access to the host clipboard, instead of just when the VM is focused. This clipboard sharing feature is without warning. A compromised guest with no need for clipboard access can install and start continuously sniffing the host clipboard.