Solaris <= 2.5.1 License Manager Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/461/info The Solaris License Manager that ships with versions 2.5.1 and 2.6 is vulnerable to multiple symlink attacks. License Manager creates lockfiles owned by root and set mode 666 which it writes to regularily. It...

Virtualmin < 3.703 Multiple Local/Remote Vulnerabilities

No description provided by source. Virtualmin Multiple Vulnerabilities by Filip Palian filip dot palian at pjwstk dot edu dot pl Software affected: Virtualmin 3.703 Description from the vendor site: Virtualmin is the world's most powerful and flexible web server control panel. Manage your virtual...

MGASA-2014-0274 Updated ctdb package fixes CVE-2013-4159

Updated ctdb packages fix security vulnerability: ctdb before 2.5 is vulnerable to symlink attacks to due the use of predictable filenames in /tmp, such as /tmp/ctdb.socket CVE-2013-4159...

openSUSE Security Update : kvm (openSUSE-SU-2012:0832-1)

fix vulnerability to temporary file symlink attacks in snapshot file mode. bnc764526 CVE-2012-2652 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-364. The text description of...

openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks CVE-2011-3872. Note: If you've set the 'certdnsnames' option in your master's puppet.conf file...

OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)

The unpacker::redirectstdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite...

Fedora 20 : check-mk-1.2.4p2-2.fc20 (2014-6810)

Install the mk-job binary on /usr/bin. - Make sure the proper permissions are given to /var/lib/checkmkagent/job to prevent any hard or symlink to be created by a normal user and pointing to any file on the filesystem exposing it on the check-mk-agent output being run as root. Note that Tenable...

GLSA-201406-03 : Fail2ban: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-03 Fail2ban: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Fail2ban. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could send a crafted URL to a websi...

Fail2ban: Multiple vulnerabilities

Background Fail2ban is a tool for parsing log files and banning IP addresses which show suspicious behavior. Description Multiple vulnerabilities have been discovered in Fail2ban. Please review the CVE identifiers referenced below for details. Impact A remote attacker could send a crafted URL to ...

GLSA-201405-12 : Ettercap: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201405-12 Ettercap: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Ettercap: Ettercap does not handle temporary files securely CVE-2010-3843. A format string flaw in Ettercap could cause a buffer overflo...

Mandriva Linux Security Advisory : libvirt (MDVSA-2014:097)

Multiple vulnerabilities has been discovered and corrected in libvirt : The LXC driver lxc/lxcdriver.c in libvirt 1.0.1 through 1.2.1 allows local users to 1 delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; 2 create arbitrary nodes...

GLSA-201405-17 : Munin: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201405-17 Munin: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Munin. Please review the CVE identifiers referenced below for details. Impact : A local attacker could perform symlink attacks to overwrite...

Munin: Multiple vulnerabilities

Background Munin is an open source server monitoring tool. Description Multiple vulnerabilities have been discovered in Munin. Please review the CVE identifiers referenced below for details. Impact A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of...

CVE-2014-1933

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...

DEBIAN-CVE-2014-1933

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...

PYSEC-2014-23

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...

PYSEC-2014-23

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...

Command injection

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...

CVE-2014-1933

CVE-2014-1933 and related flaws affect Python Imaging Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1, where temporary-file handling and command-line file-name usage enable local and symlink-based attacks (e.g., load_djpeg, EpsImagePlugin.py, IptcImagePlugin.py, Image.py). Root causes inc...

CVE-2014-1933

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...