Debian DSA-2213-1 : x11-xserver-utils - missing input sanitization

Sebastian Krahmer discovered that the xrdb utility of x11-xserver-utils, a X server resource database utility, is not properly filtering crafted hostnames. This allows a remote attacker to execute arbitrary code with root privileges given that either remote logins via xdmcp are allowed or the...

PT-2011-1088

Name of the Vulnerable Software and Affected Versions glibc versions 2.3.4 through 2.13 glibc-utils version 2.3.4 glibc-common version 2.3.4 glibc-devel version 2.3.4 glibc-profile version 2.3.4 glibc-headers version 2.3.4 nptl-devel version 2.3.4 Description The issue concerns multiple...

[SECURITY] [DSA 2213-1] x11-xserver-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2213-1 [email protected] http://www.debian.org/security/ Nico Golde April 8, 2011 http://www.debian.org/security/faq - -------------------------------------------------------------------------...

CVE-2011-1492

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

CVE-2011-1492: Improper Input Validation

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

PT-2011-3164

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.5.1 Description The issue allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request. This is due to t...

DSA-2213-1 x11-xserver-utils - missing input sanitizing

Bulletin has no description...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : x11-xserver-utils vulnerability (USN-1107-1)

Sebastian Krahmer discovered that the xrdb utility incorrectly filtered crafted hostnames. An attacker could use this flaw with a malicious DHCP server or with a remote xdmcp login and execute arbitrary code, resulting in root privilege escalation. Note that Tenable Network Security has extracted...

USN-1107-1: x11-xserver-utils vulnerability

Sebastian Krahmer discovered that the xrdb utility incorrectly filtered crafted hostnames. An attacker could use this flaw with a malicious DHCP server or with a remote xdmcp login and execute arbitrary code, resulting in root privilege escalation...

PT-2011-1087 · Gnu +1 · Glibc-Devel +7

Name of the Vulnerable Software and Affected Versions: glibc versions 2.3.4 glibc-utils versions 2.3.4 glibc-common versions 2.3.4 glibc-devel versions 2.3.4 glibc-profile versions 2.3.4 glibc-headers versions 2.3.4 nptl-devel version 2.3.4 glibc versions prior to 2.15-r3 Description: The issue...

PT-2011-1089 · Gnu +1 · Glibc-Devel +7

Name of the Vulnerable Software and Affected Versions: glibc versions 2.3.4 glibc versions prior to 2.15-r3 glibc-utils versions 2.3.4 glibc-devel versions 2.3.4 glibc-common versions 2.3.4 glibc-profile versions 2.3.4 glibc-headers versions 2.3.4 nptl-devel version 2.3.4 Description: The issue...

CVE-2011-0001

CVE-2011-0001 affects the Linux SCSI Target Framework (tgt) tgtd daemon prior to version 1.0.14 (scsi-target-utils). The vulnerability is a double-free in iscsi_rx_handler (usr/iscsi/iscsid.c) that can cause memory corruption and a crash; remote attackers may trigger this via network/blob-related...

RHEL 5 / 6 : scsi-target-utils (RHSA-2011:0332)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:0332 advisory. The scsi-target-utils package contains the daemon and tools to set up and monitor SCSI targets. Currently, iSCSI software and iSER targets are...

Important: Red Hat Security Advisory: scsi-target-utils security update

An updated scsi-target-utils package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

scsi-target-utils security update

1.0.4-3.1 - fix the buffer overflow bug before iscsi login CVE-2011-0001...

Red Hat Linux stickiness of /tmp

Exploit for linux platform in category dos / poc Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provide seunshare, a setuid root utility from...

Red Hat Enterprise Linux seunshare Unsafe Implementation

Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provide seunshare, a setuid root utility from policycore-utils intended to make new filesystem...

RedHat Linux - Stickiness of tmp

RedHat Linux - Stickiness of tmp from: http://marc.info/?l=full-disclosure&m=129842239022495&w=2 Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provi...

RedHat Linux - Stickiness of /tmp

from: http://marc.info/?l=full-disclosure&m=129842239022495&w=2 Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provide seunshare, a setuid root utili...

UBUNTU-CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...