Root privilege backdoor vulnerability in DBL Technology GSM voice gateway

DBL Technology is a communication equipment manufacturer located in Shenzhen, China. Its main products include GSM voice gateway, IP telephony gateway, enterprise softswitch, etc., which are mostly used by telephony companies and VoIP service providers. A root privilege backdoor vulnerability...

MGASA-2017-0054 Updated mariadb packages fix security vulnerability

Root Privilege Escalation CVE-2016-6664. Unspecified vulnerability affecting the Optimizer component CVE-2017-3238. Unspecified vulnerability affecting the Charsets component CVE-2017-3243. Unspecified vulnerability affecing the DML component CVE-2017-3244. Unspecified vulnerability affecting...

Updated mariadb packages fix security vulnerability

Root Privilege Escalation CVE-2016-6664. Unspecified vulnerability affecting the Optimizer component CVE-2017-3238. Unspecified vulnerability affecting the Charsets component CVE-2017-3243. Unspecified vulnerability affecing the DML component CVE-2017-3244. Unspecified vulnerability affecting...

DEBIAN-CVE-2017-6074

The dccprcvstateprocess function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCPPKTREQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service double free via an application that makes an IPV6RECVPKTINF...

CVE-2016-8972

CVE-2016-8972 affects IBM AIX 6.1, 7.1 and 7.2 via the bellmail client, enabling a local user to gain root privileges through a specially crafted command. Root access hinges on insecure permissions around bellmail; APARs IV91006–IV91011 exist. AIX advisories (bellmail_advisory.asc) and exploit re...

TP-Link C2 and C20i Default Credential Design Vulnerability

TP-Link is a Chinese manufacturer of network equipment such as routers, IOT devices, and more. A default credential design vulnerability exists in the vsftpd FTP server of the TP-Link C2 and C20i. An attacker can exploit the vulnerability to execute the system command multiple times and run with...

SUSE SLES12 Security Update : mariadb (SUSE-SU-2017:0411-1)

This mariadb version update to 10.0.29 fixes the following issues : - CVE-2017-3318: unspecified vulnerability affecting Error Handling bsc1020896 - CVE-2017-3317: unspecified vulnerability affecting Logging bsc1020894 - CVE-2017-3312: insecure error log file handling in mysqldsafe, incomplete...

SUSE-SU-2017:0412-1 Security update for mariadb

This mariadb version update to 10.0.29 fixes the following issues: - CVE-2017-3318: unspecified vulnerability affecting Error Handling bsc1020896 - CVE-2017-3317: unspecified vulnerability affecting Logging bsc1020894 - CVE-2017-3312: insecure error log file handling in mysqldsafe, incomplete...

SUSE-SU-2017:0411-1 Security update for mariadb

This mariadb version update to 10.0.29 fixes the following issues: - CVE-2017-3318: unspecified vulnerability affecting Error Handling bsc1020896 - CVE-2017-3317: unspecified vulnerability affecting Logging bsc1020894 - CVE-2017-3312: insecure error log file handling in mysqldsafe, incomplete...

CVE-2016-6649

EMC RecoverPoint and RecoverPoint for Virtual Machines are affected by multiple command injection vulnerabilities in versions prior to 4.4.1.1 and 5.0 respectively. A malicious administrator with configuration privileges can bypass the UI and escalate to root privileges. Root cause: command injec...

Debian: Security Advisory (DSA-3780-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-1093

The CVE-2017-1093 issue affects IBM AIX 6.1, 7.1, and 7.2 where a local attacker could exploit a vulnerability in the bellmail binary to gain root privileges. Connected sources corroborate a local-privilege-escalation in bellmail and tie affected TLs/versions to AIX. The Nessus advisories link th...

CVE-2016-3053

IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges...

CVE-2016-7543

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables...

UBUNTU-CVE-2016-1255

The pgctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04...

Nagios Core < 4.2.4 - Root Privilege Escalation (CVE-2016-9566)

INTRODUCTION ------------------------- Nagios Core daemon in versions below 4.2.4 was found to perform unsafe operations when handling the log file. This could be exploited by malicious local attackers to escalate their privileges from 'nagios' system user, or from a user belonging to 'nagios'...

CVE-2016-6470

A vulnerability in the installation procedure of the Cisco Hybrid Media Service could allow an authenticated, local attacker to elevate privileges to the root level. More Information: CSCvb81344. Known Affected Releases: 1.0...

CVE-2016-9638

BMC Patrol prior to 9.13.10.02 contains an elevation of privilege vulnerability in the listguests64 binary. The binary is setuid and, when executed, locates virsh via PATH and runs it with root privileges, enabling local users to gain root access. Affected: BMC Patrol up to version before 9.13.10...

CVE-2016-9774

The postinst script in the tomcat6 package before 6.0.45+dfsg-1deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu...

Huawei Play 5C phone TP touchscreen driver suffers from buffer overflow vulnerability

Huawei Play 5C is a smartphone from Huawei. A buffer overflow vulnerability exists in the TP touchscreen driver of the Huawei Play 5C phone. Due to the lack of parameter checking in the TP touchscreen driver, an attacker who gains root privileges and exploits the vulnerability can construct...