keycloak-httpd-client-install security, bug fix, and enhancement update

0.8-1 - Resolves: rhbz1673716 - Rebase k-h-c-i to version 0.8 - The rebase also includes fixes for: - rhbz1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloakcli.py - rhbz1533202 - CVE-2017-15112 keycloak-httpd-client-install: unsafe use of...

CVE-2016-10799

cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation SEC-137...

PT-2019-7595

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 58.0.4 Description The issue is related to the Pear tmp directory not being set during a PHP installation. Recommendations For versions prior to 58.0.4, update to version 58.0.4 or later to resolve the issue...

CVE-2016-10799: Improper Access Control

cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation SEC-137...

CVE-2019-13385

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log...

CVE-2019-13385: Improper Limitation of a Pathname to a Restricted Directory

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log...

Security update for bubblewrap (important)

openSUSE Security Update: Security update for bubblewrap Announcement ID: openSUSE-SU-2019:1721-1 Rating: important References: 1136958 Cross-References: CVE-2019-12439 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The rootrunner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts t...

PT-2019-12861

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access PIA VPN Client version 0.9.8 beta build 02099 Description A local attacker could overwrite arbitrary files on the system. When the client initiates a connection, it creates an XML file...

Malicious Package

Overview All versions of malicious-do-not-install contain malicious code. The package copies the contents of /etc/passwd and /etc/shadow to files in the local /tmp/ folder. Recommendation Remove the package from your environment and rotate affected credentials. References GitHub Advisory...

PT-2019-13195

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3 Description The issue allows an unprivileged user to create or overwrite files in arbitrary file system locations by preparing a symlink attack. This is due to the use of a fixed path /tmp/partclone.log in...

PT-2019-13194

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3 Description The issue allows an unprivileged user to potentially create or overwrite files in arbitrary file system locations by preparing a symlink attack in the /tmp/repo.iso path used by the...

DEBIAN-CVE-2019-12779

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without OEXCL...

CVE-2019-12779: Improper Link Resolution Before File Access

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without OEXCL...

CVE-2019-12439

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations related to XDGRUNTIMEDIR, a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code...

PT-2019-12797

Name of the Vulnerable Software and Affected Versions bubblewrap versions prior to 0.3.3 Description The issue arises from the misuse of temporary directories in /tmp as a mount point by bubblewrap.c in Bubblewrap. In specific configurations related to XDG RUNTIME DIR, a local attacker may exploi...

CVE-2018-7441

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junksplitimage.ps in prog/splitimage2pdf.c...

CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

Carriage Return And Line Feed (CRLF) Injection

Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. Refer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information about the changes in this release. The Release Notes will be available shortly fr...

CVE-2019-3937: Cleartext Storage of Sensitive Information

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in cleartext in the file /tmp/scfgdndf. A local attacker can use this vulnerability to recover sensitive data...