167 matches found
CVE-2004-2494
The CVE-2004-2494 entry describes a Cross-site Scripting (XSS) vulnerability in Ability Mail Server 1.18, exploitable through the erromsg parameter in the _error handler. The underlying issue is an input/output handling flaw that allows remote attackers to inject arbitrary web script or HTML via ...
Slackware 10.0 / 10.1 / current : kcheckpass in kdebase (SSA:2005-251-01)
New kdebase packages are available for Slackware 10.0, 10.1, and -current to fix a security issue with the kcheckpass program. Earlier versions of Slackware are not affected. A flaw in the way the program creates lockfiles could allow a local attacker to gain root privileges. %NASLMINLEVEL 70300 ...
Mandrake Linux Security Advisory : kdebase (MDKSA-2005:160)
Ilja van Sprundel from suresec.org notified the KDE security team about a serious lock file handling error in kcheckpass that can, in some configurations, be used to gain root access. In order for an exploit to succeed, the directory /var/lock has to be writeable for a user that is allowed to...
kcheckpass in kdebase
New kdebase packages are available for Slackware 10.0, 10.1, and -current to fix a security issue with the kcheckpass program. Earlier versions of Slackware are not affected. A flaw in the way the program creates lockfiles could allow a local attacker to gain root privileges. For more details abo...
CVE-2005-2494
kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files...
CVE-2005-2494
CVE-2005-2494 affects KDE kdebase/kcheckpass (kcheckpass in KDE 3.2.0 up to 3.4.2) where a symlink attack on /var/lock lock files can allow a local user to gain root privileges. Root cause: improper lock-file handling in kcheckpass. Affected environments include Red Hat/CentOS, Debian, Ubuntu adv...