DEBIAN-CVE-2011-5060

The parmktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program, a different...

DEBIAN-CVE-2011-4114

The parmktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program. NOTE:...

Design/Logic Flaw

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file...

CVE-2010-4173

The default configuration of libsdp.conf in libsdp 1.1.104 and earlier creates log files in /tmp, which allows local users to overwrite arbitrary files via a 1 symlink or 2 hard link attack on the libsdp.log. temporary file...

Novel eDirectory DHost Console 8.8 SP3 - Local Overwrite (SEH)

Novel eDirectory DHost Console 8.8 SP3 - Local Overwrite SEH Exploit Title: Novel eDirectory DHost Console 8.8 SP3 Local SEH Overwrite Date: 17/10/2010 Author: d0lc3 @rmallof - http://elotrolad0.blogspot.com/ Software Link: http://www.novell.com/ Version: 8.8 SP3 20216.67 Tested on: win32 xp sp3...

Information disclosure

Bournal before 1.4.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files associated with a --hackthegibson update check...

Beatport Player 1.0.0.283 - .m3u Local Overwrite (SEH)

Beatport Player 1.0.0.283 - .m3u Local Overwrite SEH usage: exploit.py Grab the exploit file into the program print "" print " Beatport Player 1.0.0.283 .m3u Seh Overwrite Exploit\n" print " Refer: http://www.milw0rm.com/exploits/8588\n" print " Exploit code: His0k4\n" print " Tested on: Windows ...

Beatport Player 1.0.0.283 - '.m3u' Local Overwrite (SEH)

usage: exploit.py Grab the exploit file into the program print "" print " Beatport Player 1.0.0.283 .m3u Seh Overwrite Exploit\n" print " Refer: http://www.milw0rm.com/exploits/8588\n" print " Exploit code: His0k4\n" print " Tested on: Windows XP Pro SP3 EN\n" print " greetz: TO ELITE...

HTML Email Creator 2.1b668 - html Local Overwrite (SEH)

HTML Email Creator 2.1b668 - html Local Overwrite SEH / :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered and Exploited by dun HTML Email Creator or or 520 | | NOPs jmp 11 pop-pop-ret NOPs shellcode NOPs 5...

HTML Email Creator 2.1b668 - html Local Overwrite (SEH)

/ :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered and Exploited by dun HTML Email Creator or or 520 | | NOPs jmp 11 pop-pop-ret NOPs shellcode NOPs 56 4 4 40 343 73 Greetz: suN8Hclf, str0ke...

Media Commands - '.m3u' Local Overwrite (SEH)

usage: exploit.py print "" print " Media Commands m3u File local Seh Overwrite Exploit\n" print " Founder: Hakxer" print " Exploited: His0k4" print " Tested on: Windows XP Pro SP2 Fr\n" print " Greetings to:" print " All friends & muslims HaCkersdz\n" print "" buff = "\x41" 4103 nextseh =...

Media Commands - .m3u Local Overwrite (SEH)

Media Commands - .m3u Local Overwrite SEH usage: exploit.py print "" print " Media Commands m3u File local Seh Overwrite Exploit\n" print " Founder: Hakxer" print " Exploited: His0k4" print " Tested on: Windows XP Pro SP2 Fr\n" print " Greetings to:" print " All friends & muslims HaCkersdz\n" pri...

IntelliTamper 2.07/2.08 - '.map' Local Overwrite (SEH)

!/usr/bin/python IntelliTamper 2.07/2.08 MAP File 0-day Local SEH Overwrite Exploit Bug discovered by cN4phux Tested on: IntelliTamper 2.07/2.08 / win32 SP3 FR Shellcode: Windows Execute Command calc Here's the debugger output like what u see, the EIP overwritten & attempt to read from address...

DEBIAN-CVE-2008-5371

screenie in screenie 1.30.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.screenie. temporary file...

CVE-2008-5377: Improper Link Resolution Before File Access

pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333...

CVE-2008-5145: Improper Link Resolution Before File Access

ltpmenu in ltp 20060918 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/runltp.mainmenu. temporary file...

CVE-2008-5154: Improper Link Resolution Before File Access

bluetooth.rc in p3nfs 5.19 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/blue.log temporary file...

CVE-2008-4968

The 1 rccs and 2 STUFF scripts in lmbench 3.0-a7 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/sdiff. temporary file...

CVE-2008-4983

CVE-2008-4983 affects scilab-bin 4.1.2. A local attacker can exploit insecure temporary file handling (symlink attacks) in the scilink, scidoc and scidem scripts to overwrite arbitrary files under /tmp and potentially affect files owned by the running user. Remediation per Gentoo GLSA 200901-14 i...

CVE-2008-4975: Improper Link Resolution Before File Access

mkmailpost in newsgate 1.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mmp temporary file...