GLSA-201611-19 : Tar: Extract pathname bypass

The remote host is affected by the vulnerability described in GLSA-201611-19 Tar: Extract pathname bypass Tar attempts to avoid path traversal attacks by removing offending parts of the element name at extract. This sanitizing leads to a vulnerability where the attacker can bypass the path names...

Tar: Extract pathname bypass

Background The Tar program provides the ability to create and manipulate tar archives. Description Tar attempts to avoid path traversal attacks by removing offending parts of the element name at extract. This sanitizing leads to a vulnerability where the attacker can bypass the path names specifi...

php: Invalid free() instead of efree() in phar_extract_file()

/ext/phar/pharobject.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833...

php: Integer overflow leads to buffer overflow in virtual_file_ex

Integer overflow in the virtualfileex function in TSRM/tsrmvirtualcwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service stack-based buffer overflow or possibly have unspecified other impact via a crafted extract operation on a Z...

GNU tar 1.29 Extract Pathname Bypass

---------------- t2'16 special vulnerability release ----------------- Vulnerability: POINTYFEATHER aka Tar extract pathname bypass Credits: Harry Sintonen / FSC1V Cyber Security Services Date: 2016-10-27 Impact: File overwrite in certain situations Classifier: Full spectrum cyber CVSS: 4.3.2...

Ubuntu tracker-extract Package Denial of Service Vulnerability

Ubuntu is a desktop-oriented GNU/Linux operating system developed by Canonical and the Ubuntu Foundation.Vivid is a development code name for Ubuntu. A denial of service vulnerability exists in the Ubuntu tracker-extract Package. An attacker could exploit this vulnerability to crash an applicatio...

[SECURITY] Fedora 25 Update: perl-Image-Info-1.38-6.fc25

This Perl extension allows you to extract meta information from various types of image files...

Code injection

F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files vi...

PT-2016-6670

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM systems versions 11.x before 11.2.1 HF16 F5 BIG-IP LTM systems versions 11.3.x F5 BIG-IP LTM systems versions 11.4.x before 11.4.1 HF11 F5 BIG-IP LTM systems version 11.5.0 F5 BIG-IP LTM systems versions 11.5.1 before HF11 F5...

7zip NArchive::NHfs::CHandler::ExtractZlibFile method heap buffer overflow vulnerability

7-Zip is a free, open source compression/decompression software. A heap buffer overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7-Zip 32 15.05 beta and 64 9.20. An attacker can exploit this vulnerability to execute arbitrary code...

Silicon Graphics LibTiff 'extractContigSamplesBytes' Function Denial of Service Vulnerability

Silicon Graphics LibTiff is a library for reading and writing TIFF files. A security vulnerability in the 'extractContigSamplesBytes' function of Silicon Graphics LibTiff allows remote attackers to exploit the vulnerability to construct special TIFF images that can be tricked into being parsed by...

Meteocontrol WEB’log - Admin Password Disclosure (Metasploit)

Meteocontrol WEB’log - Admin Password Disclosure Metasploit Exploit Title: Meteocontrol WEB'log - Extract Admin password Discovered by: Karn Ganeshen Vendor Homepage: http://www.meteocontrol.com/en/ Versions Reported: All Meteocontrol WEB'log versions CVE-ID: CVE-2016-2296 Meteocontrol WEB'log -...

PT-2016-1707

Name of the Vulnerable Software and Affected Versions obs-service-extract file package before 0.3-5.1 in openSUSE Leap 42.1 obs-service-extract file package before 0.3-3.1 in openSUSE 13.2 Description The issue is related to multiple unspecified vulnerabilities in the obs-service-extract file...

PT-2016-5806

Name of the Vulnerable Software and Affected Versions GNU Libtasn1 versions prior to 4.8 Description The issue allows remote attackers to cause a denial of service, specifically an infinite recursion, through a crafted certificate. This occurs when the asn1 extract der octet function in...

IBM Lotus Domino R8 - Password Hash Extraction

IBM Lotus Domino R8 - Password Hash Extraction Exploit Title: IBM Lotus Domino = R8 Password Hash Extraction Exploit Google Dork: inurl:names.nsf?opendatabase Date: 02-24-2016 Exploit Author: Jonathan Broche Contact: https://twitter.com/g0jhonny Vendor Homepage:...

UEFI firmware image viewer and editor: UEFITool

It supports parsing of full BIOS images starting with the flash descriptor or any binary files containing UEFI volumes. Original development was started here at MDL forums as a cross-platform analog to PhoenixTool ‘s structure mode with some additional features, but the program’s engine was prove...

WordPress W3 Total Cache Security Credentials Hash Extract

A hash extract vulnerability has been reported in WordPress W3 Total Cache Plugin. Successful exploitation of this vulnerability would allow a remote attacker to obtain username and password hashes from affected WordPress servers...

UBUNTU-CVE-2015-6833

Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. dot dot in a ZIP archive entry that is mishandled during an extractTo call...

SquirrelMail 1.4.5-RC1 - Arbitrary Variable Overwrite

SquirrelMail 1.4.5-RC1 - Arbitrary Variable Overwrite SquirrelMail Arbitrary Variable Overwrite Vendor: The SquirrelMail Project Team Product: SquirrelMail Version: = 1.4.5-RC1 Website: http://www.squirrelmail.org/ BID: 14254 CVE: CVE-2005-2095 SECUNIA: 16058 PACKETSTORM: 38709 Description:...

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author:...