parsec: dangerous 777 permissions for /run/parsec
Priority LOW 26CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
Why it matters now
EPSS 0.00214 11th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Factory (openSUSE): 0.8.1-1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA Factory (openSUSE) Fixed in 0.8.1-1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36781
- 2026-10-03 Alias added: GHSA-m398-vv9j-2r7f
References
More openSUSE Factory vulnerabilities
- TI-2021-18444 CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. CVSS 3.1HIGH 7.5
- TI-2021-18443 Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial… CVSS 3.1HIGH 7.5
- TI-2022-13289 sendmail: mail to root privilege escalation via sm-client.pre script CVSS 3.1HIGH 7.8
- TI-2021-20416 An issue was discovered in Cobbler before 3.3.1. CVSS 3.1HIGH 7.8
- TI-2021-03035 Out-of-bounds Read in vim/vim CVSS 3.1HIGH 7.1
- TI-2021-07558 virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group CVSS 3.1HIGH 7.8
Sources
- CVE-2021-36781 · CVE Program
- CVE-2021-36781 · NVD
- FIRST EPSS
- GHSA-m398-vv9j-2r7f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences