Matthias Gerstner of SUSE

python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root

Deprecated functionality in autoyast2 automatically imports gpg keys without checking them

race condition on texlive-filesystem cron job allows for the deletion of unintended files

apt-cacher-ng insecure use of /run/apt-cacher-ng

suddoers configuration for cscreen not restrictive enough

cscreen: usage of fixed path /tmp/cscreen.debug

obs-service-download_files allows downloading from localhost or intranet hosts

cups: ownership of /var/log/cups allows the lp user to create files as root

User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges

python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root