Debian: Security Advisory (DLA-1420-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA-1420-1] cinnamon security update

Package : cinnamon Version : 2.2.16-5+deb8u1 CVE ID : CVE-2018-13054 Debian Bug : 903201 It was discovered that there was a symlink attack in the Cinnamon desktop environment. An attacker could overwrite an arbitrary file on the filesystem via a $HOME/.face icon file as the...

Phusion Passenger nginx module elevation of privilege vulnerability

Phusion Passenger is an Apache module from the Dutch company Phusion for deploying Ruby on Rails projects on Apache and Nginx web servers. nginx module is one of the Nginx server modules. A security vulnerability in the nginx module in Phusion Passenger versions 5.3.2 through 3.x excluding versio...

CVE-2018-13054

CVE-2018-13054 affects Cinnamon 1.9.2–3.8.6 where cinnamon-settings-users.py runs as root and can overwrite any user’s ~/.face via symlink pointing to an arbitrary location, enabling a possible privilege escalation. Connected advisories (openSUSE, Fedora, SUSE, Mageia, Ubuntu) report a fix for th...

Directory Traversal

rubyzip is vulnerable to directory traversal attacks. A malicious user can pass zip file containing files with the / character or a zip file with a symlink to cause a directory traversal. This is related to CVE-2017-5946...

Security Bulletin: PowerKVM is affected by a kexec-tools vulnerability (CVE-2015-0267)

Summary PowerKVM is affected by a kexec-tools vulnerability CVE-2015-0267. Vulnerability Details CVEID: CVE-2015-0267 DESCRIPTION: kexec-tools could allow a local attacker to launch a symlink attack. The script module-setup.sh creates temporary files insecurely. A local attacker could exploit thi...

Security Bulletin: PowerKVM is affected by ppc64-diag and powerpc-utils vulnerabilities (Multiple CVEs)

Summary PowerKVM is affected by multiple vulnerabilities in ppc64-diag and powerpc-utils. Vulnerability Details CVEID: CVE-2014-4038 DESCRIPTION: ppc64-diag could allow a local attacker to launch a symlink attack. lpdelatest.sh creates temporary files insecurely. A local attacker could exploit th...

Security Bulletin: Samba vulnerability affects IBM Storwize V7000 Unified (CVE-2017-2619)

Summary IBM Storwize V7000 Unified is shipped with Samba, for which a fix is available for security vulnerability. Vulnerability Details Samba is used in IBM Storwize V7000 Unified to enable file management and authentication services for Microsoft Windows environments. CVEID: CVE-2017-2619...

Security Bulletin: Samba vulnerability affects IBM SONAS (CVE-2017-2619)

Summary IBM SONAS is shipped with Samba, for which a fix is available for security vulnerability. Vulnerability Details Samba is used in IBM SONAS to enable file management and authentication services for Microsoft Windows environments. CVEID: CVE-2017-2619 DESCRIPTION: Samba could allow a remote...

Security Bulletin: Multiple vulnerabilities in PHP as used by IBM QRadar Incident Forensics 7.2 MR2. (CVE-2014-3515, CVE-2014-4049, CVE-2014-3981, CVE-2014-0238, CVE-2014-0237, CVE-2014-4721)

Summary The PHP language version used by IBM QRadar Incident Forensics 7.2 MR2 contains multiple vulnerabilities. Vulnerability Details CVE ID: CVE-2014-3515 DESCRIPTION: PHP could allow a remote attacker to execute arbitrary code on the system, caused by a type confusion when performing an...

ALPINE-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

Design/Logic Flaw

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

DEBIAN-CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

CVE-2018-10380 affects kwallet-pam in KDE KWallet prior to 5.12.6, where local users can exploit a symlink to obtain ownership of arbitrary files. The vulnerability stems from insecure permission handling in the PAM module, enabling local privilege elevation with complete confidentiality, integri...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2013-0159

The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg...

Design/Logic Flaw

The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg...