Matthias Gerstner of SUSE

virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

libzypp stores cookies world readable

obs-service-extract_file's outfilename parameter allows to write files outside of package directory

obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories

Request controller allows to create requests with arbitrary request IDs

race condition in the packaging of texlive-filesysten

outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues

obs-service-replace_using_package_version allows to specify arbitrary input files

parsec: dangerous 777 permissions for /run/parsec

Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm