Needrestart vulnerabilities
We track 4 vulnerabilities in Needrestart products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 19, 2024.
Latest Needrestart vulnerabilities
- 7.8 High severity
needrestart: Uncontrolled Search Path Element
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
- 7.8 High severity
needrestart: Concurrent Execution using Shared Resource with Improper Synchronization
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpret
- 7.8 High severity
needrestart: Uncontrolled Search Path Element
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
- 7.8 High severity
needrestart: Improper Neutralization of Special Elements used in an OS Command
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::