CVE-2019-19882

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing...

EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2019-2662)

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.CVE-2016-6252 Note that Tenable Network...

[ASA-201912-4] shadow: privilege escalation

Arch Linux Security Advisory ASA-201912-4 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-19882 Package : shadow Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1079 Summary ======= The package shadow before version...

Dovecot < 2.2.7 Authentication Bypass Vulnerability

Dovecot is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

EulerOS 2.0 SP3 : sendmail (EulerOS-SA-2019-2661)

According to the version of the sendmail packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXE...

CVE-2017-8284

The disasinsn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated...

CVE-2019-19726

OpenBSD through 6.6 allows local users to escalate to root because a check for LDLIBRARYPATH in setuid programs can be defeated by setting a very small RLIMITDATA resource limit. When executing chpass or passwd which are setuid root, dlsetupenv in ld.so tries to strip LDLIBRARYPATH from the...

CVE-2019-3667

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members

A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...

EulerOS 2.0 SP2 : vim (EulerOS-SA-2019-2462)

According to the version of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group which may be different from the group ownershi...

EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

CVE-2015-7892

Stack-based buffer overflow in the m2m1shotcompatioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.bufout.numplanes value in an ioctl call...

CVE-2019-19519

In OpenBSD 6.6, local users can use the su -L option to achieve any login class often excluding root because there is a logic error in the main function in su/su.c...

CVE-2019-19522

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root...

Design/Logic Flaw

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGLDRIVERSPATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen...

Default configuration

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root...

Design/Logic Flaw

In OpenBSD 6.6, local users can use the su -L option to achieve any login class often excluding root because there is a logic error in the main function in su/su.c...

CVE-2019-19519

In OpenBSD 6.6, local users can use the su -L option to achieve any login class often excluding root because there is a logic error in the main function in su/su.c...

CVE-2019-19520

OpenBSD 6.6 is affected by CVE-2019-19520 (xlock) where local attackers can escalate to the auth group by manipulating LIBGL_DRIVERS_PATH. Root cause: xenocara/lib/mesa/src/loader/loader.c mishandles dlopen. Impact, per sources, is local privilege escalation; OpenBSD patches exist via syspatch/Op...

kernel: Handling of might_cancel queueing is not properly pretected against race

A race condition was found in the Linux kernel before version 4.11-rc1 in 'fs/timerfd.c' file which allows a local user to cause a kernel list corruption or use-after-free via simultaneous operations with a file descriptor which leverage improper 'mightcancel' queuing. An unprivileged local user...