CVE-2017-7572

The checkPolkitPrivilege function in serviceHelper.py in Back In Time aka backintime 1.1.18 and earlier uses a deprecated polkit authorization method unix-process that is subject to a race condition time of check, time of use. With this authorization method, the owner of a process requesting a...

quagga security and bug fix update

0.99.15-14 - Resolves: 1416013 - CVE-2017-5495 quagga: Telnet interface input buffer allocates unbounded amounts of memory 0.99.15-13 - fix path of ripd pid file 842308 0.99.15-12 - fix start function in watchqugga initscript 862826, 1208617 0.99.15-11 - fix for CVE-2013-2236 1391918 - fix for...

Joomla! Abstract component SQL injection vulnerability

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A SQL injection vulnerability exists in version 2.1 of the Joomla! Abstract component, which is caused by a failure to properly validate the pid parameter on the 'index.php'...

Joomla com_blog component 'Pid' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the 'Pid' parameter of the Joomla comblog component. An attacker can exploit the vulnerability to access or modify database data...

Joomla com_wisroyq component 'Pid' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the 'Pid' parameter of the Joomla comwisroyq component. An attacker can exploit the vulnerability to access or modify database data...

Debian DLA-838-1 : shadow security update

Tobias Stoeckmann discovered that su does not properly handle clearing a child PID. A local attacker can take advantage of this flaw to send SIGKILL to other processes with root privileges, resulting in denial of service. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DLA 838-1] shadow security update

Package : shadow Version : 4.1.5.1-1+deb7u1 CVE ID : CVE-2017-2616 Debian Bug : 855943 Tobias Stoeckmann discovered that su does not properly handle clearing a child PID. A local attacker can take advantage of this flaw to send SIGKILL to other processes with root privileges, resulting in denial ...

Joomla com_redshop component 'Pid' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the 'Pid' parameter of the Joomla comredshop component. An attacker can exploit the vulnerability to access or modify database data...

Joomla com_dcrc component 'pid' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. SQL injection vulnerability in the 'pid' parameter of the Joomla comdcrc component. An attacker can exploit the vulnerability to access or modify database data...

Linux kernel security bypass vulnerability (CNVD-2017-01860)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the time subsystem of Linux kernel 4.9.9 and earlier versions. A local attacker can exploit this vulnerability by reading the /proc/timerlis...

CVE-2017-5967

The time subsystem in the Linux kernel, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

CVE-2017-5967

The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

Design/Logic Flaw

The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

CVE-2017-5967

The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

CVE-2017-5967

The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

CVE-2017-5967

The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

CVE-2017-5967

CVE-2017-5967 affects the Linux kernel: when CONFIG_TIMER_STATS is enabled, the time subsystem through kernel 4.9.9 allows a local attacker to reveal real PID values (outside of PID namespaces) by reading /proc/timer_list, via the print_timer path in kernel/time/timer_list.c and the __timer_stats...

CVE-2017-5967

The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID values inside a PID namespace by reading the /proc/timerlist file, related to the printtimer function in kernel/time/timerlist.c and the...

CVE-2017-2618

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty null write to this file can crash the system by causing the system to attempt to access unmapped kernel memory...

Design/Logic Flaw

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or...