CVE-2019-12576

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

CVE-2019-12576

CVE-2019-12576 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The openvpn_launcher binary is setuid root and invoked during connection, executing OS utilities to configure the system. The networksetup utility is called using relative paths, and a local unpr...

CVE-2019-12573

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

CVE-2019-12573

The CVE-2019-12573 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS. The vulnerability arises in the openvpn_launcher binary, which runs with setuid root. The --log option accepts a file path and is not sanitized, allowing an authenticated loc...

CVE-2019-12577

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpnlauncher.64 is setuid root. This binary creates /tmp/piaupscript.sh when executed...

CVE-2019-12577

CVE-2019-12577 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The macOS binary openvpn_launcher.64 is setuid root and creates /tmp/pia_upscript.sh during connect; because the process’s umask is inherited and not reset, the attacker can cause world-writable ...

CVE-2019-12579

CVE-2019-12579 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux/macOS. The vulnerability is in the setuid root binary openvpn_launcher.64, which accepts system-configuration parameters that are passed to OS commands via a here document without proper sanitizat...

CVE-2019-12575

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The rootrunner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts t...

CVE-2019-12575

CVE-2019-12575 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux. The root_runner.64 binary is setuid root and executes /opt/pia/ruby/64/ruby, which loads libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can place a malicious library in that ...

PT-2019-12868

Name of the Vulnerable Software and Affected Versions Private Internet Access PIA VPN Client version v82 for Linux Description A vulnerability could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The issue involves the openvpn launcher.64 binary, which is...

PT-2019-12867

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access PIA VPN Client version v82 for macOS Description A local attacker could exploit this issue to run arbitrary code with elevated privileges. The openvpn launcher.64 binary, which is setuid root, creates...

CVE-2019-12578: Improper Neutralization of Argument Delimiters in a Command

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher.64 binary is setuid root. This binary executes /opt/pia/openvpn-64/openvpn, passing the...

CVE-2019-12571: Improper Link Resolution Before File Access

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v0.9.8 beta build 02099 for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists,...

PT-2019-12869

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access PIA VPN Client version v82 Description A vulnerability could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn launcher.64 binary is setuid root and...

PT-2019-12865

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access PIA VPN Client version v82 for Linux Description A local, authenticated attacker could exploit this issue to run arbitrary code with elevated privileges. The root runner.64 binary, which is setuid roo...

PT-2019-12861

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access PIA VPN Client version 0.9.8 beta build 02099 Description A local attacker could overwrite arbitrary files on the system. When the client initiates a connection, it creates an XML file...

CVE-2019-12577: Incorrect Permission Assignment for Critical Resource

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpnlauncher.64 is setuid root. This binary creates /tmp/piaupscript.sh when executed...

PT-2019-12863

Name of the Vulnerable Software and Affected Versions London Trust Media Private Internet Access PIA VPN Client version v82 Description A local attacker could exploit this issue to overwrite arbitrary files, potentially leading to a denial of service condition and data loss. The openvpn launcher...

CVE-2019-12576: Untrusted Search Path

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

CVE-2019-12579: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpnlauncher.64 binary is setuid root. This binary accepts several...