Low: perl-IPTables-Parse

Issue Overview: A vulnerability in perl-IPTables-Parse was found, when using predictable file names for its temporary files. This vulnerability allows attacker on a multi-user system to set up symlinks to overwrite any file the current user has write access to. Affected Packages:...

ppc64-diag: multiple temporary file races

Multiple insecure temporary file use flaws were found in the way the ppc64-diag utility created certain temporary files. A local attacker could possibly use either of these flaws to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running ppc64-diag, or...

[ MDVSA-2015:177 ] ctdb

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:177 http://www.mandriva.com/en/support/security/ Package : ctdb Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated ctdb packages fix security vulnerability: ctdb before 2.5 is...

Mandriva Linux Security Advisory : ctdb (MDVSA-2015:177)

Updated ctdb packages fix security vulnerability : ctdb before 2.5 is vulnerable to symlink attacks to due the use of predictable filenames in /tmp, such as /tmp/ctdb.socket CVE-2013-4159. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Debian DLA-28-1 : augeas security update

Multiple race conditions were discovered in augeas when saving configuration files which expose it to symlink attacks. Write access to the directory where the configuration file is located is required by the attacker. NOTE: Tenable Network Security has extracted the preceding description block...

[DLA 28-1] augeas security update

Package : augeas Version : 0.7.2-1+deb6u1 CVE ID : CVE-2012-0786 CVE-2012-0787 CVE-2013-6412 Debian Bug : 731111 731132 Multiple race conditions were discovered in augeas when saving configuration files which expose it to symlink attacks. Write access to the directory where the configuration file...

DLA-28-1 augeas - security update

Bulletin has no description...

Code injection

CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on 1 index.html, 2 index.class, 3 index.pl, 4 index.php, 5 index.pyc, or 6 index.py...

Solaris <= 2.5.1 License Manager Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/461/info The Solaris License Manager that ships with versions 2.5.1 and 2.6 is vulnerable to multiple symlink attacks. License Manager creates lockfiles owned by root and set mode 666 which it writes to regularily. It...

Virtualmin < 3.703 Multiple Local/Remote Vulnerabilities

No description provided by source. Virtualmin Multiple Vulnerabilities by Filip Palian filip dot palian at pjwstk dot edu dot pl Software affected: Virtualmin 3.703 Description from the vendor site: Virtualmin is the world's most powerful and flexible web server control panel. Manage your virtual...

MGASA-2014-0274 Updated ctdb package fixes CVE-2013-4159

Updated ctdb packages fix security vulnerability: ctdb before 2.5 is vulnerable to symlink attacks to due the use of predictable filenames in /tmp, such as /tmp/ctdb.socket CVE-2013-4159...

openSUSE Security Update : kvm (openSUSE-SU-2012:0832-1)

fix vulnerability to temporary file symlink attacks in snapshot file mode. bnc764526 CVE-2012-2652 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-364. The text description of...

openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks CVE-2011-3872. Note: If you've set the 'certdnsnames' option in your master's puppet.conf file...

OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)

The unpacker::redirectstdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite...

Fedora 20 : check-mk-1.2.4p2-2.fc20 (2014-6810)

Install the mk-job binary on /usr/bin. - Make sure the proper permissions are given to /var/lib/checkmkagent/job to prevent any hard or symlink to be created by a normal user and pointing to any file on the filesystem exposing it on the check-mk-agent output being run as root. Note that Tenable...

GLSA-201406-03 : Fail2ban: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-03 Fail2ban: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Fail2ban. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could send a crafted URL to a websi...

Fail2ban: Multiple vulnerabilities

Background Fail2ban is a tool for parsing log files and banning IP addresses which show suspicious behavior. Description Multiple vulnerabilities have been discovered in Fail2ban. Please review the CVE identifiers referenced below for details. Impact A remote attacker could send a crafted URL to ...

GLSA-201405-12 : Ettercap: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201405-12 Ettercap: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Ettercap: Ettercap does not handle temporary files securely CVE-2010-3843. A format string flaw in Ettercap could cause a buffer overflo...

GLSA-201405-17 : Munin: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201405-17 Munin: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Munin. Please review the CVE identifiers referenced below for details. Impact : A local attacker could perform symlink attacks to overwrite...

Mandriva Linux Security Advisory : libvirt (MDVSA-2014:097)

Multiple vulnerabilities has been discovered and corrected in libvirt : The LXC driver lxc/lxcdriver.c in libvirt 1.0.1 through 1.2.1 allows local users to 1 delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; 2 create arbitrary nodes...