p5-DBI -- insecure temporary file creation vulnerability

Javier Fernández-Sanguino Peña reports: The DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library...

newsgrab -- insecure file and directory creation

The newsgrab script uses insecure permissions during the creation of the local output directory and downloaded files. After a file is created, permissions on it are set using the mode value of the newsgroup posting. This can potentially be a problem when the mode is not restrictive enough. In...

Debian DSA-633-1 : bmv - insecure temporary file

Peter Samuelson, upstream maintainer of bmv, a PostScript viewer for SVGAlib, discovered that temporary files are created in an insecure fashion. A malicious local user could cause arbitrary files to be overwritten by a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[SA13758] iproute2 netbug Script Insecure Temporary File Creation

TITLE: iproute2 netbug Script Insecure Temporary File Creation SECUNIA ADVISORY ID: SA13758 VERIFY ADVISORY: http://secunia.com/advisories/13758/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: iproute2 2.x http://secunia.com/product/4495/ DESCRIPTION: Javier...

CVE-2004-2753

Unspecified vulnerability in SharedX in HP-UX B.11.00, B.11.11, and B.11.22 allows local users to access unspecified files or cause a denial of service via unknown vectors related to handling of "files in a potentially insecure manner."...

[SA13635] Rpm Finder "web()" Buffer Overflow and Insecure File Creation

TITLE: Rpm Finder "web" Buffer Overflow and Insecure File Creation SECUNIA ADVISORY ID: SA13635 VERIFY ADVISORY: http://secunia.com/advisories/13635/ CRITICAL: Moderately critical IMPACT: Privilege escalation, System access WHERE: From remote SOFTWARE: Rosiello Rpm Finder rpf 1.x...

CVE-2004-1149

The CVE-2004-1149 issue concerns Computer Associates eTrust EZ Antivirus versions 7.0.0–7.0.4 (including 7.0.1.4). The root cause is insecure default file permissions (ACLs) applied during installation, allowing a local user to modify installed files and replace a program (notably VetMsg.exe) to ...

DSA-615-1 debmake - insecure temporary file

Bulletin has no description...

iDEFENSE Security Advisory 12.15.04: Computer Associates eTrust EZ Antivirus Insecure File Permission Vulnerability

Computer Associates eTrust EZ Antivirus Insecure File Permission Vulnerability iDEFENSE Security Advisory 12.15.04 http://www.idefense.com/application/poi/display?id=164 December 15, 2004 I. BACKGROUND Computer Associates eTrust EZ Antivirus is antivirus protection software for home and business...

Mandrake Linux Security Advisory : postgresql (MDKSA-2004:149)

The Trustix development team found insecure temporary file creation problems in a script included in the postgresql package. This could allow an attacker to trick a user into overwriting arbitrary files he has access to. The updated packages have been patched to prevent this problem. %NASLMINLEVE...

GLSA-200412-05 : mirrorselect: Insecure temporary file creation

The remote host is affected by the vulnerability described in GLSA-200412-05 mirrorselect: Insecure temporary file creation Ervin Nemeth discovered that mirrorselect creates temporary files in world-writable directories with predictable names. Impact : A local attacker could create symbolic links...

Debian DSA-603-1 : openssl - insecure temporary file

Trustix developers discovered insecure temporary file creation in a supplemental script derchop of the openssl package which may allow local users to overwrite files via a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Cscope 13.0/15.x - Insecure Temporary File Creation (2)

// source: https://www.securityfocus.com/bid/11697/info Cscope creates temporary files in an insecure way. A design error causes the application to fail to verify the presence of a file before writing to it. During execution, the utility reportedly creates temporary files in the system's temporar...

Debian DSA-577-1 : postgresql - insecure temporary file

Trustix Security Engineers identified insecure temporary file creation in a script included in the postgresql suite, an object-relational SQL database. This could lead an attacker to trick a user to overwrite arbitrary files he has write access to. %NASLMINLEVEL 70300 C Tenable Network Security,...

[SA12973] OpenSSL "der_chop" Script Insecure Temporary File Creation

TITLE: OpenSSL "derchop" Script Insecure Temporary File Creation SECUNIA ADVISORY ID: SA12973 VERIFY ADVISORY: http://secunia.com/advisories/12973/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: OpenSSL 0.9.x http://secunia.com/product/253/ DESCRIPTION: A...

CVE-2004-0755

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

ghostscript -- insecure temporary file creation vulnerability

Ghostscript is affected by an insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existence of a file before writing to it. An attacker may leverage this issue to overwrite arbitrary files with the privileges...

RHEL 2.1 / 3 : ruby (RHSA-2004:441)

An updated ruby package that fixes insecure file permissions for CGI session files is now available. Ruby is an interpreted scripting language for object-oriented programming. Andres Salomon reported an insecure file permissions flaw in the CGI session management of Ruby. FileStore created world...

Low: Red Hat Security Advisory: ruby security update

An updated ruby package that fixes insecure file permissions for CGI session files is now available. Ruby is an interpreted scripting language for object-oriented programming. Andres Salomon reported an insecure file permissions flaw in the CGI session management of Ruby. FileStore created world...

Debian DSA-540-1 : mysql - insecure file creation

Jeroen van Wolffelaar discovered an insecure temporary file vulnerability in the mysqlhotcopy script when using the scp method which is part of the mysql-server package. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...