ppc64-diag: fix for tmp races and information disclosure (important)

ppc64-diag was updated to fix tmp race issues CVE-2014-4038 and a file disclosure problem in snapshot tarball generation CVE-2014-4039...

CVE-2014-4039

ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf...

DEBIAN-CVE-2014-4039

ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf...

CVE-2014-4039

The CVE-2014-4039 issue affects ppc64-diag (version 2.6.1) where 0755 permissions on /tmp/diagSEsnap and lax restrictions on /tmp/diagSEsnap/snapH.tar.gz enable a local attacker to read an archive and obtain sensitive information (e.g., contents in /var/log/messages and /etc/yaboot.conf). The vul...

CVE-2011-4039

CVE-2011-4039 affects Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report prior to 4.0, with a write access violation that can execute arbitrary code. Exploitation requires user action (opening a specially crafted file) and is not fully remote; XS...

CVE-2010-4039

CVE-2010-4039 affects Google Chrome on Linux prior to 7.0.517.41 where the process fails to properly set the PATH environment variable. The description does not specify the exact impact or attack vectors; vulnerability details are limited to this PATH handling issue. Open-source/ANSI references i...

CVE-2009-4039

Cross-site scripting XSS vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4039

CVE-2009-4039 affects Piwigo before 2.0.6. It is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML via unspecified vectors. The flaw’s root cause and impacted component are not detailed in the provided sources beyond the version boundary. Reme...

CVE-2008-4039

SQL injection vulnerability in index.php in Spice Classifieds allows remote attackers to execute arbitrary SQL commands via the catpath parameter...

CVE-2008-4039

creationtimestamp| type| source ---|---|--- 2008-09-03 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6354...

CVE-2007-4039

Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handli...

CVE-2007-4039

Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handli...

CVE-2007-4039

Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handli...

CVE-2007-4039

Technical details for CVE-2007-4039 are not publicly provided in the connected documents. The initial description is the only source with general impact; monitor for updates from official advisories or vendor disclosures.

CVE-2006-4039

CVE-2006-4039 affects GaesteChaos 0.2 and earlier. The vulnerability is in the file eintragen.php , where SQL injection is possible via the parameters gastname , gastwohnort , or gasteintrag , allowing remote attackers to execute arbitrary SQL commands. The published data cite CVSS v2 base score ...

CVE-2005-4039

Directory traversal vulnerability in arhiva.php in Web4Future Portal Solutions News Portal allows remote attackers to read arbitrary files via the dir parameter...

CVE-2005-4039

CVE-2005-4039 affects the Web4Future Portal Solutions News Portal. A directory traversal flaw in arhiva.php allows remote attackers to read arbitrary files through the dir parameter. The NVD entry lists a base score of 7.8 (HIGH) with network access and low attack complexity. The connected source...