Default configuration

The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by...

CVE-2011-1549

The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by...

CVE-2011-1550

The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as...

CVE-2011-1548

The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated...

CVE-2011-1549

The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by...

CVE-2011-1549

Summary (CVE-2011-1549) : The issue concerns the default logrotate configuration on Gentoo Linux, which runs with root privileges to process files in directories that can be written by non-root users. This enables local attackers to perform symlink and hard-link attacks by exploiting logrotate’s ...

CVE-2011-1548

CVE-2011-1548 concerns the logrotate utility on Debian-based systems, where the default configuration allows a non-root user to trigger symlink and hard-link attacks by exploiting logrotate’s handling of directories that are writable by non-root users. The underlying issue is the program processi...

CVE-2011-1548

The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated...

Gentoo Security Advisory GLSA 201006-08 (nano)

The remote host is missing updates announced in advisory GLSA 201006-08. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Ruby 'FileUtils.remove_entry_secure()' Method Race Condition Vulnerability

Ruby is prone to race condition vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ruby-lang:ruby"; ifdescription...

Gentoo Security Advisory GLSA 201006-08 (nano)

The remote host is missing updates announced in advisory GLSA 201006-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Xxe

crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to 1 determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and 2 perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on...

FreeBSD crontab information leakage

==================================== FreeBSD crontab information leakage ==================================== For its implementation of the standard UNIX cron daemon, FreeBSD uses a version based off vixie-cron. This package is installed by default, and includes a setuid-root crontab binary to...

CVE-2011-0754

The SplFileInfo::getType function in the Standard PHP Library SPL extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack...

Cross site scripting

The SplFileInfo::getType function in the Standard PHP Library SPL extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack...

CVE-2011-0754

The CVE affects PHP’s SPL extension (SplFileInfo::getType) prior to PHP 5.3.4 on Windows, where symbolic links are not detected due to the lack of FILE_ATTRIBUTE_REPARSE_POINT checking. This can enable local symlink attacks via cross-platform stat structure differences. Remediation: upgrade to PH...

Fedora 13 : php-pear-CAS-1.1.3-1.fc13 (2010-15943)

This release contains 3 security fixes for vulnerabilities in the proxy callback mechanism. These vulnerabilities only affect phpCAS clients that are running in proxy mode. The release is fully compatible with all versions 1.1.x versions. The changes are : Security Issue - CVE-2010-3690 phpCAS: X...

Fedora 12 : php-pear-CAS-1.1.3-1.fc12 (2010-15970)

This release contains 3 security fixes for vulnerabilities in the proxy callback mechanism. These vulnerabilities only affect phpCAS clients that are running in proxy mode. The release is fully compatible with all versions 1.1.x versions. The changes are : Security Issue - CVE-2010-3690 phpCAS: X...

pyftpd Multiple Vulnerabilities

pyftpd is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mathematica Arbitrary File Overwriting Vulnerability - Linux

Mathematica is prone to arbitrary file overwriting vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...