CVE-2017-15567

The certificate import component in IDEMIA formerly Morpho MorphoSmart 1300 Series aka MSO 1300 Series devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product o...

Command injection

DISPUTED The certificate import component in IDEMIA formerly Morpho MorphoSmart 1300 Series aka MSO 1300 Series devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the...

CVE-2017-7138

An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Directory Utility" component. It allows local users to discover the Apple ID of the computer's owner...

Directory traversal

An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Directory Utility" component. It allows local users to discover the Apple ID of the computer's owner...

CVE-2017-7138

An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Directory Utility" component. It allows local users to discover the Apple ID of the computer's owner...

PT-2017-14099 · Idemia · Idemia Morphosmart 1300 Series

Name of the Vulnerable Software and Affected Versions: IDEMIA MorphoSmart 1300 Series devices affected versions not specified Description: The certificate import component in IDEMIA MorphoSmart 1300 Series devices allows local users to obtain a command shell and gain privileges via unspecified...

Command injection

The Switch Configuration Tools Backend clcmdserver in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharacters in a cl-rctl command label...

Memory corruption

The TEEOS module in Huawei Mate 7 Mate7-TL10 smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service memory corruption via a crafted application...

Memory corruption

The tzdriver module in Huawei Mate 7 Mate7-TL10 smartphones before V100R001CHNC00B126SP03 allows local users to gain privileges or cause a denial of service memory corruption via an unspecified input...

CVE-2015-4422

CVE-2015-4422 concerns Huawei Mate 7 devices (Mate7-TL10) in the TEEOS module. A local attacker with root permissions can escalate privileges or trigger memory corruption leading to denial of service via a crafted app. The affected product is described as the Mate 7 with TEEOS, before the patch v...

SUSE-SU-2017:2777-1 Security update for Linux Kernel Live Patch 17 for SLE 12

This update for the Linux Kernel 3.12.60-5260 fixes one issue. The following security bugs were fixed: - CVE-2017-15274: security/keys/keyctl.c in the Linux kernel did not consider the case of a NULL payload in conjunction with a nonzero length value, which allowed local users to cause a denial o...

DEBIAN-CVE-2017-15537

The x86/fpu Floating Point Unit subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace or rtsigreturn system call, allowing local users to read...

CVE-2014-2277

The maketemporaryfilename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function...

CVE-2017-15265

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service use-after-free or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seqclientmgr.c and sound/core/seq/seqports.c...

CVE-2017-15299

The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of addkey for a key that already exists but is uninstantiated, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted system call...

CVE-2016-4924

An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product...

CVE-2017-12192

The keyctlreadkey function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service OOPS and system crash via a crafted...

UBUNTU-CVE-2017-12192

The keyctlreadkey function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service OOPS and system crash via a crafted...

CVE-2015-8239

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed...

Command injection

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed...