CVE-2019-12571

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v0.9.8 beta build 02099 for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists,...

CVE-2019-12573

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

CVE-2019-12574

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v0.9.8 beta build 02099 for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists,...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpnlauncher.64 binary is setuid root. This binary accepts several...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpnlauncher.64 is setuid root. This binary creates /tmp/piaupscript.sh when executed...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The rootrunner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts t...

CVE-2019-12574

The CVE-2019-12574 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client for Windows (v1.0). It is vulnerable to a DLL injection flaw during the software updater process: the updater loads multiple libraries from a folder that authenticated users can write to, enabling a ...

CVE-2019-12578

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher.64 binary is setuid root. This binary executes /opt/pia/openvpn-64/openvpn, passing the...

CVE-2019-12578

Summary: CVE-2019-12578 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux. An authenticated, local attacker can exploit a setuid root helper (openvpn_launcher.64) that executes /opt/pia/openvpn-64/openvpn with command-line parameters. Although dangerous OpenVPN...

CVE-2019-12571

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v0.9.8 beta build 02099 for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists,...

CVE-2019-12571

Affected software: London Trust Media Private Internet Access (PIA) VPN Client for macOS, v0.9.8 beta (build 02099). Vulnerability details: When the client connects, it creates the XML file /tmp/pia-watcher.plist. If this file exists, it is truncated and its contents overwritten by an attacker wi...

CVE-2019-12576

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

CVE-2019-12576

CVE-2019-12576 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The openvpn_launcher binary is setuid root and invoked during connection, executing OS utilities to configure the system. The networksetup utility is called using relative paths, and a local unpr...

CVE-2019-12573

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

CVE-2019-12573

The CVE-2019-12573 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS. The vulnerability arises in the openvpn_launcher binary, which runs with setuid root. The --log option accepts a file path and is not sanitized, allowing an authenticated loc...

CVE-2019-12577

CVE-2019-12577 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The macOS binary openvpn_launcher.64 is setuid root and creates /tmp/pia_upscript.sh during connect; because the process’s umask is inherited and not reset, the attacker can cause world-writable ...