Low: Red Hat Security Advisory: fam security update

Updated fam packages that fix an information disclosure bug are now available. FAM, the File Alteration Monitor, provides a daemon and an API which applications can use for notification of changes in specific files or directories. A bug has been found in the way FAM handles group permissions. It ...

CVE-2004-2228

Mozilla Firefox before 1.0 is installed with world-writable permissions on Mac OS X, which allows local users to gain privileges...

CVE-2004-0907

The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8, create certain files with insecure permissions, which could allow local users to overwrite those files and execute arbitrary code...

CVE-2004-0452

Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack...

CVE-2004-0752

OpenOffice OOo 1.1.2 creates predictable directory names with insecure permissions during startup, which may allow local users to read or list files of other users...

cdrecord fails to set proper permissions on programs specified in RSH environment variable

Overview Cdrecord can call external programs specified by the RSH environment variable. This may permit a malicious local user to gain elevated privileges. Description Cdrecord is an application used to create data or audio compact discs. Cdrecord permits the use of CD recorders on remote machine...

Insecure file permissions in the Firefox browser for Linux >= v0.9

after installing firefox many of the permissions are set to 777, allowing anyone on the system to change the contents of the executable files. this first occured in the 0.9 release in the tar.gz release as well as in the installer. the problem or is it called a feature now? still exists in the...

CVE-2002-1196

editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set...

Mandrake Linux Security Advisory : mgetty (MDKSA-2003:053-1)

Two vulnerabilities were discovered in mgetty versions prior to 1.1.29. An internal buffer could be overflowed if the caller name reported by the modem, via Caller ID information, was too long. As well, the faxspool script that comes with mgetty used a simple permissions scheme to allow or deny f...

Fedora Core 1 : kernel-2.4.22-1.2194.nptl (2004-186)

Numerous problems referencing userspace memory were identified in several device drivers by Al Viro using the sparse tool. The Common Vulnerabilities and Exposures project cve.mitre.org assigned the name CVE-2004-0495 to this issue. A problem was found where userspace code could execute certain...

RHEL 2.1 : mgetty (RHSA-2003:008)

Updated Mgetty packages are now available to fix a possible buffer overflow and a permissions problem. Mgetty is a getty replacement for use with data and fax modems. Mgetty can be configured to run an external program to decide whether or not to answer an incoming call based on Caller ID...

Important: Red Hat Security Advisory: kdelibs security update

Updated kdelibs packages that fix telnet URI handler and mailto URI handler file vulnerabilities are now available. The kdelibs packages include libraries for the K Desktop Environment. KDE Libraries include: kdecore KDE core library, kdeui user interface, kfm file manager, khtmlw HTML widget, ki...

iweb.traversal.txt

October 22 2003 Directory Traversal Attacks on iWeb Web Server. This is an advisory I did not bother posting to Bugtraq or Full disclosure because its not a very widespread application. The following two directory traversal attacks will work on iWeb mini http server...

vpopmail weak permissions

/etc/vpopmail.conf file with cleartext SQL password is world readable...

CVE-2003-0501

The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of those entries...

ScriptLogic $LOGS Share Remote Information Disclosure

The remote host has an accessible LOGS$ share. ScriptLogic creates this share to store the logs, but does not properly set the permissions on it. As a result, anyone can use it to read or modify, or possibly execute code. C Tenable Network Security, Inc. include"compat.inc"; if description...

[RHSA-2003:036-01] Updated mgetty packages available

--------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated mgetty packages available Advisory ID: RHSA-2003:036-01 Issue date: 2003-04-08 Updated on: 2003-04-08 Product: Red Hat Linux Keywords: mgetty spool permission Cross references:...

Low: Red Hat Security Advisory: : : : Updated mgetty packages available

Updated mgetty packages are now available for Red Hat Linux 7.1, 7.2, 7.3, and 8.0. These updates close a possible buffer overflow and a permissions problem present in versions of mgetty prior to version 1.1.29. Updated 16 April 2003 Added packages for Red Hat Linux on IBM iSeries and pSeries...

CVE-2002-0355

netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions...

CVE-2003-0012

The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data...