Design/Logic Flaw

xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process, which might allow local users to bypass file permissions and read other users' files, or obtain other sensitive information, by reading the xterm process memory. NOT...

CVE-2007-0823

CVE-2007-0823 affects xterm on Slackware Linux 10.2, where information displayed to one user could remain in the same xterm process memory and be readable by subsequent users sharing that interactive process. This could allow local users to bypass file permissions and obtain sensitive information...

CVE-2007-0823

xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process, which might allow local users to bypass file permissions and read other users' files, or obtain other sensitive information, by reading the xterm process memory. NOT...

CVE-2007-0473

CVE-2007-0473 affects Smb4K prior to 0.8.0. The writeFile function in smb4k/core/smb4kfileio.cpp does not preserve /etc/sudoers file permissions across modifications, allowing a local attacker to read /etc/sudoers contents. The vulnerability is local with read access to a sensitive file if the at...

CVE-2006-6743

CVE-2006-6743 affects phpProfiles prior to 2.1.1. The vulnerability arises from world-writable permissions on certain profile files and directories, enabling local users to modify or delete files. Affected elements include (1) users/include/do_makeprofile.inc.php and (2) users/include/copy.inc.ph...

CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6614

The CVE-2006-6614 issue affects Fully Automatic Installation (FAI) 2.10.1 (and possibly 3.1.2). When verbose mode is enabled, the save_log_local function writes the root password hash to /var/log/fai/current/fai.log, and the log file’s permissions permit copying to other hosts when fai-savelog is...

CVE-2006-6382

CVE-2006-6382 affects Positive Software H-Sphere prior to 2.5.0 RC3. The control panel creates log files in a user’s directory with insecure permissions, enabling local users to append log data to arbitrary files via a symlink attack. The description notes the provenance is from third‑party infor...

Weak KDE Kate / Kwrite / Kile text processors file permissions

Backup files are created with weak permissions...

CVE-2006-6085

Kile before 1.9.3 does not assign a backup file the same permissions as the original file, which might allow local users to obtain sensitive information...

CVE-2006-6085

Kile before 1.9.3 stores backup files with inadequate permissions, potentially exposing sensitive information to local users. The CVE-2006-6085 description specifies this permission issue as the root cause. Affected: Kile

iDefense Security Advisory 11.08.06: Cisco Secure Desktop Privilege Escalation Vulnerability

Cisco Secure Desktop Privilege Escalation Vulnerability iDefense Security Advisory 11.08.06 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 08, 2006 I. BACKGROUND Cisco Secure Desktop allows secure VPN connections from remote PCs and offers functionality to ensure PCs meet administrato...

CVE-2006-5298

The muttadvmktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safefopen function cal...

CVE-2006-5298

The muttadvmktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safefopen function cal...

CVE-2006-5298

The CVE-2006-5298 issue affects Mutt 1.5.12 and earlier, where mutt_adv_mktemp may fail to ensure temporary files are created with restricted permissions, enabling a local user to create files with weak permissions via a race between mktemp and safe_fopen. Multiple connected advisories (Ubuntu US...

Debian DSA-903-2 : unzip - race condition

The unzip update in DSA 903 contained a regression so that symbolic links that are resolved later in a zip archive aren't supported anymore. This update corrects this behaviour. For completeness, below please find the original advisory text : Imran Ghory discovered a race condition in the...

CVE-2006-4493

xbiff2 1.9 creates $HOME/.xbiff2rc in a user's home directory with insecure file permissions, which allows local users to obtain sensitive information such as login credentials. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-4493

The affected component is xbiff2 1.9. It creates $HOME/.xbiff2rc in the user’s home directory with insecure permissions, enabling local users to access sensitive information such as login credentials. This summary relies on the CVE description and notes the provenance is unknown (third‑party info...

CVE-2006-4493

xbiff2 1.9 creates $HOME/.xbiff2rc in a user's home directory with insecure file permissions, which allows local users to obtain sensitive information such as login credentials. NOTE: the provenance of this information is unknown; the details are obtained from third party information...