CVE-2012-0809

Format string vulnerability in the sudodebug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo...

CVE-2012-0809

Format string vulnerability in the sudodebug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo...

CVE-2012-0809

CVE-2012-0809 is a format-string vulnerability in the sudo_debug() function present in sudo versions 1.8.0 through 1.8.3p1, enabling local privilege escalation by supplying a crafted program name. The vulnerability is evidenced in multiple connected sources (Gentoo GLSA-201203-06, openSUSE patch ...

PT-2012-1102

Name of the Vulnerable Software and Affected Versions sudo versions 1.8.0 through 1.8.3p1 sudo version 1.8.3 p2 and earlier Description The issue concerns multiple vulnerabilities in the sudo package, which can be exploited locally to compromise the confidentiality, integrity, and availability of...

FreeBSD : sudo -- format string vulnerability (7c920bb7-4b5f-11e1-9f47-00e0815b8da8)

Todd Miller reports : Sudo 1.8.0 introduced simple debugging support that was primarily intended for use when developing policy or I/O logging plugins. The sudodebug function contains a flaw where the program name is used as part of the format string passed to the fprintf function. The program na...

sudo 1.8.3p1 Format String

Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products sudo 1.8.0 - 1.8.3p1 http://sudo.ws Vendor communication 2012-01-24 Send vulnerability details to sudo maintainer 2012-01-24 Maintainer is embarrased 2012-01-27 Asking maintainer how the fixing goes...

sudo -- format string vulnerability

Todd Miller reports: Sudo 1.8.0 introduced simple debugging support that was primarily intended for use when developing policy or I/O logging plugins. The sudodebug function contains a flaw where the program name is used as part of the format string passed to the fprintf function. The program nam...

GLSA-201201-06 : iSCSI Enterprise Target: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201201-06 iSCSI Enterprise Target: Arbitrary code execution Multiple functions in usr/iscsi/isns.c of iSCSI Enterprise Target contain format string errors. Impact : A remote attacker could send a specially crafted Internet Storage...

Corona iOS Jailbreak Tool Released

A security researcher has released a tool that will untether iPhones and other devices running iOS 5.01, allowing them to run unsigned code. The tool relies on a pair of exploits, one in an iOS binary and another in the kernel, and the jailbreak will survive after a reboot. The tool, called Coron...

BroadWin WebAccess SCADA Client ActiveX Format String

Added: 12/12/2011 OSVDB: 74897 Background BroadWin WebAccess is a web-based SCADA reporting and control solution. Problem BroadWin WebAccess installs an ActiveX Control in the user's browser. The OcxSpool function of this control accepts a parameter that is evaluated using a format string. A form...

CVE-2011-4357

Format string vulnerability in the pcgierror function in python/neocgi.c in the Python CGI Kit neocgi module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via format string specifiers that are not properly handled...

DEBIAN-CVE-2011-4357

Format string vulnerability in the pcgierror function in python/neocgi.c in the Python CGI Kit neocgi module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via format string specifiers that are not properly handled...

CVE-2011-4357

Format string vulnerability in the pcgierror function in python/neocgi.c in the Python CGI Kit neocgi module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via format string specifiers that are not properly handled...

CVE-2011-4357

Format string vulnerability in the pcgierror function in python/neocgi.c in the Python CGI Kit neocgi module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via format string specifiers that are not properly handled...

CVE-2011-4357

CVE-2011-4357 describes a format string vulnerability in the p_cgi_error function of the Clearsilver neo_cgi module (Python CGI Kit) affecting Clearsilver 0.10.5 and earlier. This allows remote attackers to crash the process and potentially execute arbitrary code via unhandled CGI error message f...

Debian DSA-2355-1 : clearsilver - format string vulnerability

Leo Iannacone and Colin Watson discovered a format string vulnerability in the Python bindings for the Clearsilver HTML template system, which may lead to denial of service or the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

DSA-2355-1 clearsilver - format string vulnerability

Bulletin has no description...

CVE-2011-0185

Format string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS X before 10.7.2 allows local users to gain privileges via a crafted name of an executable file...

FreeBSD : pecl-phar -- format string vulnerability (da3d381b-0ee6-11e0-becc-0022156e8794)

Entry for CVE-2010-2094 says : Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information memory contents and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the 1...

DEBIAN-CVE-2011-1764

Format string vulnerability in the dkimeximverifyfinish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service daemon crash via format string specifiers in data used in DKIM logging, as demonstrated by an identity field...