5594 matches found
opensuse-updater符号链接本地信息泄漏漏洞
BUGTRAQ ID: 29608 CVE ID：CVE-2008-2389 CNCVE ID:CNCVE-20082389 opensuse-updater是一款类似apt-get的软件包更新实现。 opensuse-updater处理符号链接存在问题，本地攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 S.u.S.E. opensuse-updater 0 S.u.S.E. openSUSE 10.2 SUSE-SR:2008:012已经修正此漏洞：...
Linux Kernel fcntl_setlk()函数本地竞争条件漏洞
BUGTRAQ ID: 29076 CVECAN ID: CVE-2008-1669 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux kernel没有对fcntl功能应用某些保护机制，本地攻击者可以在SMP系统上利用fcntlsetlk与close调用之间的竞争条件获得对文件描述符表的不正确序列访问，这可能导致拒绝服务的情况。 Linux kernel 2.6.25.2 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
CVE-2008-1675
The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...
Design/Logic Flaw
The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...
CVE-2008-1675
The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...
CVE-2008-1675
The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...
Design/Logic Flaw
Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09...
CVE-2008-1831
Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka 1 SEBL01, 2 SEBL02, 3 SEBL03, 4 SEBL04, 5 SEBL05, and 6 SEBL06...
CVE-2008-1812
CVE-2008-1812 affects the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+, Application Server 1.0.2.2, and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5. The vulnerability is described as unspecified with unknown impact and local attack vectors (EM01). The connected ...
CVE-2008-1819
Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09...
CVE-2008-1812
Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+; Application Server 1.0.2.2; and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5 has unknown impact and local attack vectors, aka EM01...
CVE-2008-1831
Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka 1 SEBL01, 2 SEBL02, 3 SEBL03, 4 SEBL04, 5 SEBL05, and 6 SEBL06...
IBM AIX 'man'本地特权提升漏洞
BUGTRAQ ID: 28180 CNCAN ID:CNCAN-2008031105 IBM AIX是一款商业性质的操作系统。 IBM AIX 'man'没有使用全路径两进制，本地攻击者可以利用漏洞提升特权。 目前没有详细漏洞细节提供。 IBM AIX 6.1 补丁下载： IBM AIX 6.1 IBM IZ17177 http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html...
IBM AIX逻辑卷标管理器多个命令本地缓冲区溢出漏洞
BUGTRAQ ID: 27431 IBM AIX是一款商业性质的UNIX操作系统。 AIX的逻辑卷标管理命令工具集实现上存在缓冲区溢出漏洞，本地攻击者可能利用此漏洞提升自己的权限。 AIX的逻辑卷标管理器提供了一套用于管理逻辑卷标的工具。逻辑卷标管理器的bos.rte.lvm和bos.clvm.enh命令中存在缓冲区溢出漏洞。如果本地攻击者执行了以下bos.rte.lvm命令： /usr/sbin/lchangevg /usr/sbin/ldeletepv /usr/sbin/putlvodm /usr/sbin/lvaryoffvg /usr/sbin/lvgenminor...
CORE FORCE防火墙和注册模块多个本地内核缓冲区溢出漏洞
BUGTRAQ ID: 27341 CNCAN ID:CNCAN-2008012102 CORE FORCE是一款免费的防火墙应用程序。 CORE FORCE防火墙和注册模块不正确验证用户提供的输入，本地攻击者可以利用漏洞进行拒绝服务攻击或提升特权。 CORE FORCE的防火墙内核驱动可通过IOCTL函数访问，防火墙驱动模块中的四个IOCTL函数使用从用户空间的输入，并没有对输入缓冲区长度进行正确的验证，通过使用特定构建的参数调用任何一个IOCTL，非特权用户可在这个驱动中触发漏洞并导致拒绝服务攻击，可能导致任意特权提升。 Core Security Technologies CORE...
CVE-2008-0347
Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2; Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; and Application Server 9.0.4.3 and 10.1.2.0.2; has unknown impact and local attack vectors, aka OCS01. NOTE: Oracle has not disputed a reliable claim that...
Debian Security Advisory DSA 956-1 (lsh-utils)
The remote host is missing an update to lsh-utils announced via advisory DSA 956-1. Stefan Pfetzing discovered that lshd, a Secure Shell v2 SSH2 protocol server, leaks a couple of file descriptors, related to the randomness generator, to user shells which are started by lshd. A local attacker can...
Kerio WinRoute防火墙未明代理验证绕过漏洞
Kerio WinRoute Firewall是一款商业性质的防火墙应用程序。 Kerio WinRoute Firewall存在未明安全问题，本地攻击者可以利用漏洞绕过代理验证，未授权访问受限资源。 目前没有详细漏洞细节提供。 Kerio WinRoute Firewall 6.2.3 Kerio WinRoute Firewall 6.2.2 Kerio WinRoute Firewall 6.2.1 Kerio WinRoute Firewall 6.2 Kerio WinRoute Firewall 6.1.4 Patch 2 Kerio WinRoute Firewall...
Xen mov_to_rr RID本地安全绕过漏洞
Xen是一款开放源代码虚拟机监视器。 Xen不正确验证用户输入，本地攻击者可以利用漏洞绕过安全，获得敏感信息。 针对movtorr的RID值缺少过滤，可允许一个VTi域读取其他域的内存信息，造成敏感信息泄露。 XenSource Xen 3.1.1 XenSource Xen 3.0.3 XenSource Xen 3.0 可参考如下地址获得补丁信息： http://xenbits.xensource.com/xen-3.1-testing.hg...
Xen mov_to_rr调用RID本地绕过安全限制漏洞
BUGTRAQ ID: 26716 CVECAN ID: CVE-2007-6207 Xen是可用于Linux内核的一种虚拟化技术，允许同时运行多个操作系统。 Xen在调用movtorr时没有正确地检查RID（区域标识符），这允许VT-i域中的本地攻击者读取其他VT-i域中的内存。 XenSource Xen 3.1.1 XenSource Xen 3.0.3 XenSource Xen 3.0 XenSource --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://xen.xensource.com/...