CVE-2005-1264

Raw character devices raw.c in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589...

CVE-2005-1264

Raw character devices raw.c in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589...

CVE-2005-1589

The CVE-2005-1589 issue affects the Linux kernel’s pktcdvd (and raw device) ioctl handler. In kernel 2.6.12-rc4 and earlier, pkt_ioctl in pktcdvd.c calls the wrong function when issuing an ioctl to the block device, which can leak kernel address space to user space. This local-privilege scenario ...

[UNIX] Linux Kernel pktcdvd and rawdevice ioctl Race Condition

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Linux kernel pktcdvd privilege escalation

Rawdevice ioctl handler parameters are not checked...

CVE-2005-1399

CVE-2005-1399 affects FreeBSD 4.6–4.11 and 5.x–5.4, where insecure default permissions on the /dev/iir device allow unprivileged local users to issue restricted ioctl calls to access or modify data on hardware managed by the iir driver. This results in partial impacts to confidentiality, integrit...

CVE-2005-1399

FreeBSD 4.6 to 4.11 and 5.x to 5.4 uses insecure default permissions for the /dev/iir device, which allows local users to execute restricted ioctl calls to read or modify data on hardware that is controlled by the iir driver...

FreeBSD-SA-05:06.iir

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:06.iir Security Advisory The FreeBSD Project Topic: Incorrect permissions on /dev/iir Category: core Module: sysdev Announced: 2005-05-06 Credits: Christian...

CVE-2005-0848

Multiple games developed by FUN labs, including 4X4 Off-road Adventure III, Big Game Hunter, Dangerous Hunts, Deer Hunt, Revolution, Secret Service, Shadow Force, and US Most Wanted, allow remote attackers to cause a denial of service via an empty UDP packet to the server, which cannot detect tha...

CVE-2005-1126

The SIOCGIFCONF ioctl ifconf function in FreeBSD 4.x through 4.11 and 5.x through 5.4 does not properly clear a buffer before using it, which allows local users to obtain portions of sensitive kernel memory...

CVE-2005-1126

CVE-2005-1126 is a kernel memory disclosure vulnerability tied to the SIOCGIFCONF (ifconf) path. In FreeBSD 4.x (4.0–4.11) and 5.x (5.0–5.4), the ifconf code may copy uninitialized kernel memory to user space because the buffer is not cleared before use, enabling local users to obtain portions of...

CVE-2005-0848

CVE-2005-0848 affects multiple FUN Labs games (4X4 Off-road Adventure III, Big Game Hunter, Dangerous Hunts, Deer Hunt, Revolution, Secret Service, Shadow Force, US Most Wanted). The issue: remote attackers can cause a denial of service by sending an empty UDP packet to the game server; the serve...

CVE-2005-0180

Multiple integer signedness errors in the sgscsiioctl function in scsiioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copyfromuser and copytouser functions...

security flaw

Multiple integer signedness errors in the sgscsiioctl function in scsiioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copyfromuser and copytouser functions...

CVE-2004-0919

The syscons CONSSCRSHOT ioctl in FreeBSD 5.x allows local users to read arbitrary kernel memory via 1 negative coordinates or 2 large coordinates...

Fedora Core 2 : kernel-2.6.10-1.8_FC2 (2005-014)

This update rebases the kernel to match the upstream 2.6.10 release, and adds a number of security fixes by means of adding the latest -ac patch. CVE-2004-1235 Paul Starzetz from isec.pl found a problem in the binary format loaders uselib function that could lead to potential priveledge escalatio...

FreeBSD syscons integer overflow

CONSSCRSHOT ioctl for syscons invalidely handles negative values...

FreeBSD-SA-04:15.syscons

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:15.syscons Security Advisory The FreeBSD Project Topic: Boundary checking errors in syscons Category: core Module: sysdevsyscons Announced: 2004-10-04 Credits:...

Boundary checking errors in syscons

The syscons CONSSCRSHOT ioctl2 does insufficient validation of its input arguments. In particular, negative coordinates or large coordinates may cause unexpected behavior. It may be possible to cause the CONSSCRSHOT ioctl to return portions of kernel memory. Such memory might contain sensitive...

Fedora Core 1 : kernel-2.4.22-1.2194.nptl (2004-186)

Numerous problems referencing userspace memory were identified in several device drivers by Al Viro using the sparse tool. The Common Vulnerabilities and Exposures project cve.mitre.org assigned the name CVE-2004-0495 to this issue. A problem was found where userspace code could execute certain...