Security Bulletin

ICQ Server Flaw Lets Attackers Log In to Any Account Without Password

A bug reported to Rootshell revealed that ICQ's authentication servers could be accessed using any account's UIN paired with a 9-character password, bypassing the real password entirely. The developer of a Linux ICQ client discovered the flaw after a user mistyped a password but was still logged in, tracing it to a buffer overflow in Mirabilis's server-side password check. Rootshell confirmed the bug and published exploit details, including sample code and a 'password' like '123456789' that overruns the 8-character buffer.

opennet.ru · 2026-10-13

Qubes OS patches Dom0 code execution flaw in qvm-copy-to-vm tool

Qubes OS disclosed QSB 118, a vulnerability in the qvm-copy-to-vm utility that lets a compromised qube inject arbitrary commands into dom0 when a user copies files to it. The flaw stems from insufficient sanitization of a file name reported back through the qfile protocol's error-reporting mechanism, which dom0 displays without properly neutralizing malicious content. Users are advised to update normally to receive the fix, with no other action required.

qubes-os.org · 2026-08-30