Linux Kernel 4.14.0-rc4+ - 'waitid()' Privilege Escalation(CVE-2017-5123)

This is a guest post by a young and talented Portuguese exploiter, Federico Bento. He won this year’s Pwnie for Epic Achievement exploiting TIOCSTI ioctl. Days ago he posted a video demonstrating an exploit for CVE-2017-5123 and luckly for you I managed to convince him to do a write-up about it. ...

Buffer overflow

In /drivers/isdn/i4l/isdnnet.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree...

CVE-2017-12762

In /drivers/isdn/i4l/isdnnet.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree...

CVE-2017-12762

CVE-2017-12762 : Affected by a buffer overflow in the Linux kernel ISDN I4L driver. In /drivers/isdn/i4l/isdn_net.c, a user-controlled buffer is copied into a local buffer of fixed size with strcpy (no length check), leading to overflow. Impacted trees: Linux kernel 4.9-stable, 4.12-stable, 3.18-...

PT-2017-2720 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.18-stable through 4.12-stable Description: The issue is caused by a buffer overflow in the Linux kernel due to a user-controlled buffer being copied into a local buffer of constant size using the strcpy function withou...

CVE-2017-11472

CVE-2017-11472 affects the Linux kernel via the acpi_ns_terminate() path in drivers/acpi/acpica/nsutils.c. The flaw does not flush the operand cache, enabling a local user to dump kernel memory and bypass KASLR by crafting an ACPI table, with impact described for kernels before 4.12 (and through ...

xfrm Out-Of-Bounds Read Vulnerability

When dealing with XFRMMSGMIGRATE message, xfrmmigrate func does not check dir value of xfrmuserpolicyid. This will cause out of bound access to net-xfrm.policybydst in policyhashdirect func and others when dir value exceeds XFRMPOLICYMAX. Linux kernel versions 4.12 and below are affected. Issue...

[SECURITY] Fedora 26 Update: libtasn1-4.12-1.fc26

A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding func tions...

Linux lp.c Out-of-Bounds Write via Kernel Command-line

Vulnerable Versions Linux 4.12-rc1 and below Linux 3.x Linux 2.6.x Linux 2.4.x Linux 2.2.x Mitigation Patch has been committed to the mainline tree, available in the 4.12-rc2 release. 3.18 / 4.4 stable releases with the patch are also avaialble see timeline. Technical Details Due to a missing...

Security update for seamonkey (important)

This update for Seamonkey to version 2.46 fixes security issues and bugs. The following vulnerabilities were fixed: - Fix all Gecko related security issues between 43.0.1 and 49.0.2 - CVE-2016-6354: buffer overrun in flex boo990856 The following non-security changes are included: - improve...

openSUSE Security Update : seamonkey (openSUSE-2017-189)

This update for SeaMonkey to version 2.46 fixes security issues and bugs. The following vulnerabilities were fixed : - Fix all Gecko related security issues between 43.0.1 and 49.0.2 - CVE-2016-6354: buffer overrun in flex boo990856 The following non-security changes are included : - improve...

Buffer overflow

The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve call. This would allow user-supplied argument/environment variable lists to trigger a buffer overrun. This affects all releases o...

CVE-2016-6830

The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve call. This would allow user-supplied argument/environment variable lists to trigger a buffer overrun. This affects all releases o...

Penetration Testers Distro: Pentoo

Pentoo is a Live CD and Live USB designed for penetration testing and security assessment. Based on Gentoo Linux , Pentoo is provided both as 32 and 64 bit installable livecd. Pentoo is also available as an overlay for an existing Gentoo installation. It features packet injection patched wifi...

CVE-2014-8118

Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow...

Fedora 21 : ruby-2.1.4-24.fc21 (2014-14096)

Update to Ruby 2.1.4. Include only vendor directories, not their content rhbz1114071. Fix 'invalid regex' warning for non-rubygem packages rhbz1154067. Use load macro introduced in RPM 4.12. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

OpenConf 4.11 - authoredit.php Blind SQL Injection

OpenConf 4.11 - authoredit.php Blind SQL Injection ?php / --------------------------------------------------------------------- OpenConf = 4.11 author/edit.php Remote Blind SQL Injection Exploit --------------------------------------------------------------------- author...............: Egidio...

Gentoo Security Advisory GLSA 200412-07 (file)

The remote host is missing updates announced in advisory GLSA 200412-07. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2002-0555

IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it...

CVE-2000-1075

The provided data confirms CVE-2000-1075 affects iPlanet products: Certificate Management System 4.2 and Directory Server 4.12. The vulnerability is a directory traversal in the Agent, End Entity, or Administrator services that allows remote attackers to read arbitrary files on the server by send...