Oracle Solaris Third-Party Patch Update : hplip (cve_2013_0200_link_following)

The remote Solaris system is missing necessary patches to address security updates : - HP Linux Imaging and Printing HPLIP through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the 1 /tmp/hpcupsfilterc .bmp, 2 /tmp/hpcupsfilterk.bmp, 3 /tmp/hpcupsjob.out, 4...

Oracle Solaris Third-Party Patch Update : logilab-common (multiple_symlink_attack_vulnerabilities_in)

The remote Solaris system is missing necessary patches to address security updates : - The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on...

Ubuntu 14.04 LTS : coreutils vulnerabilities (USN-2473-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2473-1 advisory. It was discovered that the distcheck rule in dist-check.mk in GNU coreutils allows local users to gain privileges via a symlink attack on a directory tre...

USN-2473-1: coreutils vulnerabilities

It was discovered that the distcheck rule in dist-check.mk in GNU coreutils allows local users to gain privileges via a symlink attack on a directory tree under /tmp. This issue only affected Ubuntu 10.04 LTS. CVE-2009-4135 Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly...

CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

DEBIAN-CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

UBUNTU-CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

CVE-2014-6407

CVE-2014-6407 affects Docker up to 1.3.2, where attackers could write arbitrary files and execute code via a symlink or hard link attack in an image archive during pull or load. Evidence from connected docs shows fixed in the openSUSE/SUSE docker 1.3.2 update (docker-docker-stable forks) addressi...

PT-2014-7210 · Docker +1 · Docker +1

Name of the Vulnerable Software and Affected Versions: Docker versions prior to 1.3.2 Description: The issue allows remote attackers to write to arbitrary files and execute arbitrary code via a symlink or hard link attack in an image archive during a pull or load operation. This can be achieved...

CVE-2014-4703

lib/parseini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701...

CVE-2014-3627

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during...

Design/Logic Flaw

lib/parseini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701...

Authentication flaw

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during...

CVE-2014-4703

lib/parseini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701...

CVE-2014-4703

lib/parseini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701...

CVE-2014-3627

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during...

CVE-2014-3627

CVE-2014-3627 affects the YARN NodeManager in Apache Hadoop (versions 0.23.0–0.23.11 and 2.x prior to 2.5.2). The root cause is a symlink/localization handling issue in the distributed cache within a public tar archive when Kerberos authentication is used, enabling remote cluster users to change ...

CVE-2014-4703

lib/parseini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701...

CVE-2014-4703

CVE-2014-4703 affects Nagios Plugins 2.0.2. The issue is in lib/parse_ini.c: a local user can obtain sensitive information from INI configuration files via a symlink attack on the extra-opts flag. This vulnerability exists due to an incomplete fix for CVE-2014-4701. No exploit details or affected...