SuSE 10 Security Update : multipath-tools (ZYPP Patch Number 6083)

Default permissions on the multipathd socket file were to generous and allowed any user to connect. CVE-2009-0115 This update also contains the following fixes : - Error checking in VECTORXXX defines. bnc469269 - Correct definition of dbgmalloc - Double free on path release - Use noflush for...

NetBSD 5.0.1 - 'IRET' General Protection Fault Handling Privilege Escalation

/ source: https://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges or may aid in further attacks. ...

NetBSD 5.0.1 - IRET General Protection Fault Handling Privilege Escalation

NetBSD 5.0.1 - IRET General Protection Fault Handling Privilege Escalation / source: https://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may all...

fuser -- missing user's privileges check

Denis Barov reports: sysutils/fuser allows user to send any signal to any process when installed with suid bit...

kernel: information leak in sigaltstack

The dosigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack...

dTunes 2.72 (Filename Processing) Local Format String PoC

Exploit for unknown platform in category dos / poc ========================================================= dTunes 2.72 Filename Processing Local Format String PoC ========================================================= !/usr/bin/perl dTunes 2.72 local format string PoC filename processing...

linux/x86 killall5 polymorphic shellcode 61 bytes

Exploit for linux/x86 platform in category shellcode ================================================= linux/x86 killall5 polymorphic shellcode 61 bytes ================================================= / Title: Linux x86 | Polymorphic Shellcode killall5 - 61 bytes Author: Jonathan Salwan killall...

openSUSE Security Update : kernel (kernel-559)

This update fixes several security issues and hundreds of bugs in the openSUSE 11.1 kernel. The kernel was also updated to the stable version 2.6.27.19 and is now the same kernel as we are planning to ship with SUSE Linux Enterprise 11. This introduces kABI changes, so all kernel module packages...

MySQL <= 5.0.45 post auth format string vulnerability

MySQL tested: Version 5.0.45 on CentOS Linux Format String Vulnerability MySQL General Available GA Release is vulnerable. Latest MySQL Version is not vulnerable since the bug if ifdef'ed off. from mysql-5.0.75 source mysql-5.0.75.tar.gz in the file libmysqld/sqlparse.cc this source code is also...

SuSE Security Advisory SUSE-SA:2009:032 (kernel)

The remote host is missing updates announced in advisory SUSE-SA:2009:032. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

kernel: 'kill sig -1' must only apply to caller's pid namespace

The killsomethinginfo function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID -1, which allows local users to bypass the intended namespace isolation, and send arbitrary signals to all processes in all namespaces, via ...

Mandriva Linux Security Advisory : kernel (MDVSA-2009:118)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONEPARE...

kernel: exit_notify: kill the wrong capable(CAP_KILL) check

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

Debian DSA-1800-1 : linux-2.6 - denial of service/privilege escalation/sensitive memory leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, privilege escalation or a sensitive memory leak. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0028 Chris Evans discovered a situation in which ...

Linux kernel minor signal handling vulnerability

The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONEPARENT flag, and then letting this new process exit...

kernel: exit_notify: kill the wrong capable(CAP_KILL) check

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

Linux kernel minor signal handling vulnerability

The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONEPARENT flag, and then letting this new process exit...

Design/Logic Flaw

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

CVE-2009-1337

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

CVE-2009-1338

The killsomethinginfo function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID -1, which allows local users to bypass the intended namespace isolation, and send arbitrary signals to all processes in all namespaces, via ...