2041 matches found
OpenBSD vga privilege escalation
vgaioctl syscall allows code execution in kernel...
OpenBSD 3.x - 4.0 vga_ioctl() Local Root Exploit
Exploit for bsd platform in category local exploits ================================================ OpenBSD 3.x - 4.0 vgaioctl Local Root Exploit ================================================ / Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja v...
OpenBSD 3.x 4.0 - vga_ioctl() Local Privilege Escalation
OpenBSD 3.x 4.0 - vgaioctl Local Privilege Escalation / Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja van Sprundel ilja.netric.org Some code had been stolen from noir's openbsd exploit sources Fix is available:...
OpenBSD 3.x < 4.0 - 'vga_ioctl()' Local Privilege Escalation
/ Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja van Sprundel ilja.netric.org Some code had been stolen from noir's openbsd exploit sources Fix is available: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/i386/007agp.patch Critical Security...
Null pointer dereference
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
CVE-2007-0085
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
CVE-2007-0085
The CVE-2007-0085 entry concerns the OpenBSD wscons VGA graphics driver (sys/dev/pci/vga_pci.c) on OpenBSD 3.9 and 4.0. When the kernel is built with the PCIAGP option and a non-AGP device is used, a local user may gain privileges. The root cause is described as an UNSPECIFIED vulnerability with ...
CVE-2007-0085
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
[SA23608] OpenBSD "vga" Privilege Escalation Vulnerability
TITLE: OpenBSD "vga" Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA23608 VERIFY ADVISORY: http://secunia.com/advisories/23608/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: OpenBSD 4.0 http://secunia.com/product/12486/ OpenBSD 3.x...
CVE-2007-0085: Undefined Security Weakness
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
CVE-2006-6730
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode SMM handler via a write to an SMRAM address within /dev/xf86 aka the video card...
CVE-2006-6730
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode SMM handler via a write to an SMRAM address within /dev/xf86 aka the video card...
CVE-2006-6730
CVE-2006-6730 affects OpenBSD and NetBSD. The vulnerability allows local users to execute code with root privileges by killing the display server and writing to the X.Org /dev/xf86 device to replace the System Management Mode (SMM) handler via an SMRAM write within /dev/xf86 (the video card RAM r...
CVE-2006-6730: Undefined Security Weakness
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode SMM handler via a write to an SMRAM address within /dev/xf86 aka the video card...
CVE-2006-6397
Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is...
CVE-2006-6397
Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is...
CVE-2006-6397
The CVE-2006-6397 entry concerns an alleged integer overflow in the banner/banner.c component across FreeBSD, NetBSD, and OpenBSD. The issue is disputed by CVE and others and, because the banner is not setuid, an exploit would not cross privilege boundaries in normal operations; the notes explici...
PT-2006-7008 · Freebsd +2 · Freebsd +2
Name of the Vulnerable Software and Affected Versions: No vulnerable software versions are specified, as the issue is disputed and not considered a vulnerability. Description: The issue in question pertains to an alleged integer overflow in the banner/banner.c file within FreeBSD, NetBSD, and...
CVE-2006-6397: Undefined Security Weakness
Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is...
CVE-2006-6164
The dlunsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LDPRELOAD to loading processes, which might be leveraged to gain privileges...