MGASA-2014-0159 Updated python-pillow packages fix insecure use of temporary files

Updated python-imaging packages fix security vulnerabilities: Jakub Wilk discovered that temporary files were insecurely created via mktemp in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perfo...

CVE-2014-0899: Undefined Security Weakness

ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition aka WPAR for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands...

PT-2014-3805

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions prior to 10.01 Description The certificate-import feature in the Certificate Authority Proxy Function CAPF CLI implementation has an issue that allows local users to read or modify arbitrary files...

PT-2014-3806

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager Unified CM versions 10.01 and earlier Description The issue allows local users to read or modify arbitrary files. Recommendations For versions 10.01 and earlier, update to a version later than 10.01 to...

MGASA-2014-0089 Updated python-numpy packages fix security vulnerabilities

f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859...

UBUNTU-CVE-2014-1833

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink...

CVE-2014-1833: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink...

PT-2014-3437 · Festvocal · Flite

Name of the Vulnerable Software and Affected Versions: Flite version 1.4 Description: The issue allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. This is due to a problem in the play wave from socket function in audio/auserver.c. Recommendations: For Flite version...

CVE-2014-0027: Improper Link Resolution Before File Access

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

Synology DiskStation Manager arbitrary file modification

Overview Synology DiskStation Manager versions 4.3-3776-3 and below contain a vulnerability that allows a remote unauthenticated user to append arbitrary data to an arbitrary file under root privileges. Description CWE-284: Improper Access Control - CVE-2013-6955Synology DiskStation Manager...

PT-2013-1635

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the local file editor in the fabric-interconnect component, which allows local users to gain privileges and read or modify arbitrary files. This ...

CVE-2012-4096

The local file editor in the Baseboard Management Controller BMC in Cisco Unified Computing System UCS allows local users to gain privileges and modify arbitrary fabric-interconnect files, in the context of a vi process, via unspecified commands, aka Bug ID CSCtn06574...

CVE-2013-1495: Improper Link Resolution Before File Access

asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp...

CVE-2013-0219

System Security Services Daemon SSSD before 1.9.4, when 1 creating, 2 copying, or 3 removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files...

CVE-2012-3500: Concurrent Execution using Shared Resource with Improper Synchronization

scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary 1 standard output or 2 standard error output file...

PT-2012-4726

Name of the Vulnerable Software and Affected Versions logol version 1.5.0 Description The issue allows local users to delete or overwrite arbitrary files due to world writable permissions for the /var/lib/logol/results directory. Recommendations For logol version 1.5.0, consider changing the...

WikkaWiki Multiple Security Vulnerabilities

WikkaWiki is prone to multiple security vulnerabilities, including: - An SQL injection vulnerability. - An arbitrary file upload vulnerability. - An arbitrary file deletion vulnerability. - An arbitrary file download vulnerability. - A PHP code injection vulnerability. SPDX-FileCopyrightText: 201...

Apache Tomcat 7.0.0 < 7.0.19 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.19. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.19security-7 advisory. - Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled...

PT-2011-3634

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 7.1.x through 7.1.3 VMware Player versions 3.1.x through 3.1.3 VMware Fusion versions 3.1.x through 3.1.2 VMware ESXi versions 3.5 through 4.1 VMware ESX versions 3.0.3 through 4.1 Description The issue allows guest...

CVE-2011-2145: Undefined Security Weakness

mount.vmhgfs in the VMware Host Guest File System HGFS in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1, when a Solaris or FreeBSD guest OS is used, allows guest OS users to...