Design/Logic Flaw

Use-after-free vulnerability in the O3D plug-in in Google Chrome OS before 26.0.1410.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper management of ownership relationships involving Elements and DrawElements...

Fedora 18 : glibc-2.16-30.fc18 (2013-4100)

Fix multibyte character processing crash in regexp CVE-2013-0242. Fix ownership of /usr/lib64/audit 894307. Rename release engineering directory to releng' 903754. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable...

[SECURITY] [DSA 2650-1] libvirt-bin security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2650-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

Debian DSA-2650-2 : libvirt - files and device nodes ownership change to kvm group

Bastian Blank discovered that libvirtd, a daemon for management of virtual machines, network and storage, would change ownership of devices files so they would be owned by user 'libvirt-qemu' and group 'kvm', which is a general purpose group not specific to libvirt, allowing unintended write acce...

Debian Security Advisory DSA 2650-2 (libvirt - files and device nodes ownership change to kvm group)

Bastian Blank discovered that libvirtd, a daemon for management of virtual machines, network and storage, would change ownership of devices files so they would be owned by user libvirt-qemu and group kvm , which is a general purpose group not specific to libvirt, allowing unintended write access ...

[SECURITY] [DSA 2650-1] libvirt-bin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2650-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

DSA-2650-1 libvirt - files and device nodes ownership change to kvm group

Bulletin has no description...

Scientific Linux Security Update : dovecot on SL6.x i386/x86_64 (20130221)

Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. A remote, authenticated user could use these flaws to bypass intended access restrictions or conduct a directory traversal attack by leveraging login scripts. CVE-2011-2166, CVE-2011-2167 A...

Cisco MARS Information Disclosure Vulnerability

A vulnerability in the configuration of the XML parser of the Cisco Security Monitoring, Analysis and Response System MARS could allow an unauthenticated, remote attacker to have "read" access to part of information stored in the affected system. The vulnerability is due to improper handling of X...

dovecot security update

CentOS Errata and Security Advisory CESA-2013:0520 Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS...

Gambas /tmp Directory Hijack

Gambas Directory hijack vulnerability The gambas software package creates a directory in tmp to work from without verifying another user hasn't already created it. This allows a local user to hijack ownership. Describe the problem. Gambas creates a directory in /tmp called gambas.UID where UID is...

Privilege escalation in the calendar application - ownCloud

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ Affected Software ownCloud Server 4.5.7 CVE-2013-0304 Action Taken It is recommended that all instances...

Server: Privilege escalation in the calendar application

Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Fedora 18 : proftpd-1.3.4b-5.fc18 (2013-0437)

Jann Horn reported that there is a possible race condition in the handling of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and the attacker is on the same physical machine as a running proftpd. This race applies to modsftp and the handling of the MKDIR SFTP request as well...

Fedora 17 : proftpd-1.3.4b-5.fc17 (2013-0483)

Jann Horn reported that there is a possible race condition in the handling of the MKD/XMKD FTP commands, when the UserOwner directive is involved, and the attacker is on the same physical machine as a running proftpd. This race applies to modsftp and the handling of the MKDIR SFTP request as well...

DEBIAN-CVE-2012-6095

ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the 1 MKD or 2 XMKD commands...

Race condition

ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the 1 MKD or 2 XMKD commands...

CVE-2012-6095

ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the 1 MKD or 2 XMKD commands...

CVE-2012-6095

ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the 1 MKD or 2 XMKD commands...

CVE-2012-6095

CVE-2012-6095 affects ProFTPD prior to 1.3.5rc1. When using the UserOwner directive, a race condition with a symlink attack on the MKD or XMKD commands lets a local user modify ownership of arbitrary files. The vulnerability arises from insecure handling of temporary files during directory creati...