sos: Usage of predictable temporary files allows privilege escalation

An insecure temporary file use flaw was found in the way sos created certain sosreport files. A local attacker could possibly use this flaw to perform a symbolic link attack to reveal the contents of sosreport files, or in some cases modify arbitrary files and escalate their privileges on the...

Debian Insecure Temporary File Handling Vulnerability

Debian is a free operating system. Debian uses an insecure way of handling temporary files, allowing a local attacker to exploit the vulnerability to overwrite arbitrary user files...

GNU Troff contrib/pdfmark/pdfroff.sh backlink vulnerability

Groff GNU Troff is the latest open source implementation of Troff, a document preparation system that generates print and screen documents from the same input source for a variety of devices. A backlink vulnerability exists in contrib/pdfmark/pdfroff.sh in versions of GNU Troff prior to 1.21. The...

ppc64-diag: multiple temporary file races

Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or...

fedora-business-cards Insecure Temporary File Creation Vulnerability

Fedora is a Linux-based operating system developed by the Fedora Project community and sponsored by Red Hat. fedora-business-cards is a business card generator. An insecure temporary file creation vulnerability exists in fedora-business-cards, which stems from the program using an insecure way to...

Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01260)

Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Phusion Passenger 4.0.37 suffers from a symbolic link attack vulnerability due to the program not creating temporary files in a secure manner. An...

GNU Coreutils Insecure Temporary File Creation Vulnerability

The GNU Coreutils are the basic file, shell and text manipulation tools used by the GNU operating system. An insecure temporary file creation vulnerability exists in GNU Coreutils that allows a local access attacker to potentially obtain sensitive information or perform a symbolic link attack to...

Cscope 13.0/15.x Insecure Temporary File Creation Vulnerabilities (1)

No description provided by source. source: http://www.securityfocus.com/bid/11697/info Cscope creates temporary files in an insecure way. A design error causes the application to fail to verify the presence of a file before writing to it. During execution, the utility reportedly creates temporary...

openSUSE Security Update : fail2ban (openSUSE-SU-2011:1175-1)

fail2ban IP used insecure temporary files when unbanning an IP address CVE-2009-5023. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update fail2ban-5301. The text description of this plugin is C SU...

openSUSE Security Update : fail2ban (openSUSE-SU-2011:1175-1)

fail2ban IP used insecure temporary files when unbanning an IP address CVE-2009-5023. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update fail2ban-5301. The text description of this plugin is C SU...

openSUSE Security Update : python-eyeD3 (openSUSE-SU-2014:0619-1)

This python-eyeD3 update fixes the following security issue : - bnc863744: Fixed insecure use of temporary files CVE-2014-1934. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-34...

Adobe Reader Temporary Files Arbitrary File Overwrite Vulnerability - Linux

Adobe Reader is prone to symlink attack vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:acrobatreader";...

OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)

The unpacker::redirectstdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite...

CVE-2014-1876

The unpacker::redirectstdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite...

[SECURITY] [DSA 2831-1] puppet security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2831-1 [email protected] http://www.debian.org/security/ Luciano Bello December 31, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2831-1 (puppet - insecure temporary files)

An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. OpenVAS Vulnerability Test $Id: deb2831.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated fr...

DSA-2829-1 hplip - several

Bulletin has no description...

UBUNTU-CVE-2013-4437

Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...

OpenJDK: insecure temporary file permissions (JRE, 7143606)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.237 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux...

OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows local users to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented o...