1191 matches found
CVE-2018-19012: Improper Privilege Management
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Via a specific dialog it is possible to break out of the kiosk mode and reach the underlying operating system. By breaking out of the kiosk mode, an attacker ...
PT-2019-9704
Name of the Vulnerable Software and Affected Versions Drager Infinity Delta versions all Drager Delta XL versions all Drager Kappa versions all Drager Infinity Explorer C700 versions all Description The issue allows an attacker to break out of the kiosk mode and reach the underlying operating...
gVisor runsc Guest -> Host Breakout Via Filesystem Cache Desync
Exploit for linux platform in category dos / poc gVisor runsc guest-host breakout via filesystem cache desync The following writeup describes an attack that can be used to overwrite files in the host filesystem /etc/crontab in my PoC from inside a Docker container that uses gVisor's runsc. I test...
MGASA-2018-0398 Updated docker packages fix security vulnerabilities
Updated docker packages fix security vulnerabilities: Lack of content verification in docker allowed a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing CVE-2017-14992. The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi...
Updated docker packages fix security vulnerabilities
Updated docker packages fix security vulnerabilities: Lack of content verification in docker allowed a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing CVE-2017-14992. The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi...
docker: container breakout without selinux in enforcing mode
The default OCI Linux spec in oci/defaultslinux.go in Docker/Moby, from 1.11 to current, does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling Bluetooth or turning up/down keyboard brightness...
docker: container breakout without selinux in enforcing mode
The default OCI Linux spec in oci/defaultslinux.go in Docker/Moby, from 1.11 to current, does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling Bluetooth or turning up/down keyboard brightness...
About the security content of watchOS 4.3.2
About the security content of watchOS 4.3.2 This document describes the security content of watchOS 4.3.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
About the security content of macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan
About the security content of macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan This document describes the security content of macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan. About Apple security updat...
[ASA-201805-11] runc: privilege escalation
Arch Linux Security Advisory ASA-201805-11 ========================================== Severity: High Date : 2018-05-16 CVE-ID : CVE-2016-9962 Package : runc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-134 Summary ======= The package runc before version...
PT-2018-4340
Name of the Vulnerable Software and Affected Versions open buildservice versions 2.4 through 2.4.7 open buildservice versions 2.5 through 2.5.6 open buildservice versions 2.6 through 2.6.2 Description The issue allows buildservice users to potentially break out of confinement or cause denial of...
Vobot Clock Remote Code Execution Vulnerability
The Vobot Clock is a smart bedside alarm clock equipped with Amazon Alexa, Sleep Coach and Daily Routine programs. A remote code execution vulnerability exists in VOBOT CLOCK versions prior to 0.99.30. The vulnerability arises due to the use of plaintext HTTP to download the breakout program. A...
Design/Logic Flaw
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers can execute arbitrary code by watching for a local user to launch the Breakout Easter Egg feature, and then sending a crafted HTTP respon...
CVE-2018-6826
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers can execute arbitrary code by watching for a local user to launch the Breakout Easter Egg feature, and then sending a crafted HTTP respon...
PT-2018-17762
Name of the Vulnerable Software and Affected Versions VOBOT CLOCK versions prior to 0.99.30 Description An issue allows man-in-the-middle attackers to execute arbitrary code by exploiting the use of cleartext HTTP to download a breakout program. This can be achieved by watching for a local user t...
CVE-2018-6826: Undefined Security Weakness
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers can execute arbitrary code by watching for a local user to launch the Breakout Easter Egg feature, and then sending a crafted HTTP respon...
CVE-2018-6560
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon...
PT-2018-17635
Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 0.8.9 Flatpak versions 0.9.x Flatpak versions 0.10.x prior to 0.10.3 Description The issue allows crafted D-Bus messages to the host to be used to break out of the sandbox. This is due to differences in whitespace...
CVE-2018-6560: Interpretation Conflict
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon...
Tor Linux Sandbox Breakout Via X11
Tor: Linux sandbox breakout via X11 From inside the Linux sandbox described in https://blog.torproject.org/blog/tor-browser-70-released, it is still possible to talk to the X server without any restrictions. This means that a compromised browser can e.g. use the XTEST X protocol extension at...