Mozilla: Sandbox escape using Prompt:Open

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing...

CVE-2019-12936

BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions...

DEBIAN-CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to errors in the implementation of the inter-process communication authentication mechanism, allows an attacker to escalate their privileges and escape from the isolated software environment.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to errors in the implementation of the inter-process communication authentication mechanism. Exploiting this vulnerability can allow a malicious actor to increase their privileges and gain access...

DEBIAN-CVE-2018-12365

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox...

DEBIAN-CVE-2016-7035

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain roo...

CVE-2017-5456

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR 52.1 and Firefox 53...

IBM Client Application Access and Notes Elevation of Privilege Vulnerability (CNVD-2018-03879)

IBM Client Application Access and IBM Notes are both products of IBM Corporation in the U.S. IBM Client Application Access is a set of tools for accessing local applications.IBM Notes is a set of collaborative office software. An elevation of privilege vulnerability exists in IBM Client Applicati...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...

CVE-2018-1410

IBM Notes Diagnostics IBM Client Application Access and IBM Notes could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138709...

CVE-2018-1409

IBM Notes Diagnostics IBM Client Application Access and IBM Notes could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708...

Mailbutler Shimo Elevation of Privilege Vulnerability

Shimo is a multi-protocol VPN client for Mac OS. An elevation of privilege vulnerability exists in Mailbutler Shimo before 4.1.5.1. The vulnerability arises because com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service. An attacker can use this vulnerability to execut...

Debian: Security Advisory (DLA-891-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-17809

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...

CVE-2017-17809

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...

WebKit and WebKitGTK+ Remote Code Execution Vulnerability

WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine , currently used by Apple Safari and Google Chrome and other browsers.WebKitGTK + is a multi-function port for the WebKit rendering engine . A security vulnerability exists in t...

CVE-2017-12816

In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware application to get unauthorized access to the product functionality by using Android IPC...

aRts and kdelibs3 hijacking vulnerabilities

aRts is a modular audio synthesizer. kdelibs3 is a KDE API reference library from the KDE community created on top of the Qt framework, which provides the framework and numerous features to develop KDE software, making applications easier to write and providing consistency with the KDE desktop...

The vulnerability of the Linux operating system, which allows a perpetrator to trigger a service failure or cause other effects.

The vulnerability of the msmipcrouterclose function in the net/ipcrouter/ipcroutersocket.c file of the ipcrouter component of the Linux operating system, used in Qualcomm Innovation Center QuIC Android for MSM devices and other products, is related to pointer dereferencing errors. Exploiting this...

DEBIAN-CVE-2017-7875

In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free...