DEBIAN-CVE-2017-5985

lxc-user-nic in Linux Containers LXC allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check...

CVE-2017-5985

CVE-2017-5985 affects LXC’s lxc-user-nic component, where missing netns ownership checks let a local user with a lxc-usernet allocation create host interfaces and pick their names. The issue is documented across multiple vendors and advisories (openSUSE, Mageia, Arch Linux) with fixes in updated ...

CVE-2017-5985

lxc-user-nic in Linux Containers LXC allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check...

Server: Calendar export: Authorization Bypass Through User-Controlled Key

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

PT-2017-6631 · Red Hat +1 · Abrt +2

Name of the Vulnerable Software and Affected Versions: ABRT affected versions not specified Description: The issue concerns the kernel-invoked coredump processor in ABRT, which fails to properly check file ownership before writing core dumps. This allows local users with write permissions to the...

UBUNTU-CVE-2014-3684

The tmadopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager aka TORQUE Resource Manager 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary...

DEBIAN-CVE-2013-4419

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitra...

UBUNTU-CVE-2013-4419

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitra...

CVE-2013-4419

CVE-2013-4419 affects libguestfs guestfish when using --remote/--listen: temporary socket ownership is not properly checked under /tmp/.guestfish-$UID/, allowing a local user to pre-create that directory and then write to the socket to execute commands. Affected are libguestfs versions up to and ...

Server: Privilege escalation in the calendar application

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calendarid" GET parameter to /apps/calendar/ajax/events.php Note: Successful exploitation of this privilege escalation requires the "calendar" app to be enabl...

DEBIAN-CVE-2011-4114

The parmktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program. NOTE:...

kernel: GFS2: The setflags ioctl() doesn't check file ownership

The dogfs2setflags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request...

Gentoo Security Advisory GLSA 200808-12 (postfix)

The remote host is missing updates announced in advisory GLSA 200808-12. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1629-1 (postfix)

The remote host is missing an update to postfix announced via advisory DSA 1629-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2006-6246

Photo Organizer 2.32b and earlier does not properly check the ownership of certain objects, which allows remote attackers to gain unauthorized access via vectors related to 1 camera del, 2 camera edit, 3 folder/album deletion, 4 photo.move, 5 content.indexer, 6 folder.content, and possibly other...

CVE-2006-6246

Photo Organizer 2.32b and earlier does not properly check the ownership of certain objects, which allows remote attackers to gain unauthorized access via vectors related to 1 camera del, 2 camera edit, 3 folder/album deletion, 4 photo.move, 5 content.indexer, 6 folder.content, and possibly other...

insmod.linux.txt

Date: Tue, 30 Mar 1999 22:08:13 -0500 From: Brian Szymanski To: [email protected] Subject: linux insmod bug/security vulnerability Howdy all, Recently I discovered a bug in insmod that would require a lot of time and luck to exploit, but is nonetheless important for systems wanting rock-solid...