Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The rootrunner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts t...

Design/Logic Flaw

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

CVE-2019-12574

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

CVE-2019-12574

The CVE-2019-12574 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client for Windows (v1.0). It is vulnerable to a DLL injection flaw during the software updater process: the updater loads multiple libraries from a folder that authenticated users can write to, enabling a ...

CVE-2019-12578

Summary: CVE-2019-12578 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux. An authenticated, local attacker can exploit a setuid root helper (openvpn_launcher.64) that executes /opt/pia/openvpn-64/openvpn with command-line parameters. Although dangerous OpenVPN...

CVE-2019-12571

Affected software: London Trust Media Private Internet Access (PIA) VPN Client for macOS, v0.9.8 beta (build 02099). Vulnerability details: When the client connects, it creates the XML file /tmp/pia-watcher.plist. If this file exists, it is truncated and its contents overwritten by an attacker wi...

CVE-2019-12571

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v0.9.8 beta build 02099 for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists,...

CVE-2019-12576

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

CVE-2019-12576

CVE-2019-12576 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The openvpn_launcher binary is setuid root and invoked during connection, executing OS utilities to configure the system. The networksetup utility is called using relative paths, and a local unpr...

CVE-2019-12573

The CVE-2019-12573 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS. The vulnerability arises in the openvpn_launcher binary, which runs with setuid root. The --log option accepts a file path and is not sanitized, allowing an authenticated loc...

CVE-2019-12573

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

CVE-2019-12577

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpnlauncher.64 is setuid root. This binary creates /tmp/piaupscript.sh when executed...

CVE-2019-12577

CVE-2019-12577 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The macOS binary openvpn_launcher.64 is setuid root and creates /tmp/pia_upscript.sh during connect; because the process’s umask is inherited and not reset, the attacker can cause world-writable ...

CVE-2019-12579

CVE-2019-12579 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux/macOS. The vulnerability is in the setuid root binary openvpn_launcher.64, which accepts system-configuration parameters that are passed to OS commands via a here document without proper sanitizat...

CVE-2019-12575

CVE-2019-12575 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux. The root_runner.64 binary is setuid root and executes /opt/pia/ruby/64/ruby, which loads libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can place a malicious library in that ...

CVE-2019-12575

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The rootrunner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts t...

CVE-2019-12572

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client 1.0.2 build 02363 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. On startup, the PIA Windows service pia-service.exe loads the OpenSSL library from...

CVE-2019-12572

CVE-2019-12572 affects London Trust Media Private Internet Access (PIA) VPN Client for Windows 1.0.2 (build 02363). On startup, pia-service.exe loads libeay32.dll which seeks C:\etc\ssl\openssl.cnf; a low-privilege user can create that path and a malicious openssl.cnf to load a forged OpenSSL eng...