Fedora 18 : libuser-0.58-3.fc18 (2013-4571)

This update fixes a TOCTOU race condition when copying and removing directory trees. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

[SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples

CVE-2013-0248 Apache Commons FileUpload - Insecure examples Severity: Low Vendor: The Apache Software Foundation Versions Affected: - Commons FileUpload 1.0 to 1.2.2 Description: Commons FileUpload provides file upload capability for Servlets and web applications. During the upload process,...

Apache Commons FileUpload不安全临时文件创建漏洞(CVE-2013-0248)

BUGTRAQ ID: 58326 CVECAN ID: CVE-2013-0248 Apache Commons FileUpload软件包可以向小服务程序和Web应用添加高性能的文件上传功能。 Apache Commons FileUpload v1.0 - 1.2.2在上传文件过程中，会将上传的文件临时存在磁盘上，默认的位于系统的tmp目录内。因为临时文件具有可预测的文件名，并存储在可公开写入的位置，这就易于受到TOCTOU攻击。成功攻击需要攻击者对tmp目录具有写访问权限。将存储位置设在不能公开写入的位置，可以防止此攻击。 0 Apache Group Commons...

sssd security, bug fix and enhancement update

1.9.2-82 - Resolves: rhbz888614 - Failure in memberof can lead to failed database update 1.9.2-81 - Resolves: rhbz903078 - TOCTOU race conditions by copying and removing directory trees 1.9.2-80 - Resolves: rhbz903078 - Out-of-bounds read flaws in autofs and ssh services responders 1.9.2-79 -...

Mandriva Linux Security Advisory : systemd (MDVSA-2012:030)

A vulnerability has been found and corrected in systemd : A TOCTOU race condition was found in the way the systemd-logind login manager of the systemd, a system and service manager for Linux, performed removal of particular records related with user session upon user logout. A local attacker coul...

Mandriva Update for systemd MDVSA-2012:030 (systemd)

Check for the Version of systemd OpenVAS Vulnerability Test Mandriva Update for systemd MDVSA-2012:030 systemd Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for systemd MDVSA-2012:030 (systemd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[ MDVSA-2012:030 ] systemd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:030 http://www.mandriva.com/security/ Package : systemd Date : March 16, 2012 Affected: 2011. Problem Description: A vulnerability has been found and corrected in systemd: A TOCTOU race condition was found i...

RHEL 6 : logrotate (RHSA-2011:0407)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2011:0407 advisory. The logrotate utility simplifies the administration of multiple log files, allowing the automatic rotation, compression, removal, and mailin...

OpenJDK File TOCTOU deserialization vulnerability (6736390)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.225, and 1.3.127 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than...

New local NT attack - TOCTOU (Time-Of-Check-to-Time-Of-Use race conditions)

If service hooks are used for argument filtering, race conditions are possible between argument check and actual sytem call...

Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 (java-1.6.0-openjdk)

Check for the Version of java-1.6.0-openjdk OpenVAS Vulnerability Test Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 java-1.6.0-openjdk Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 (java-1.6.0-openjdk)

Check for the Version of java-1.6.0-openjdk OpenVAS Vulnerability Test Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 java-1.6.0-openjdk Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

OpenJDK File TOCTOU deserialization vulnerability (6736390)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.225, and 1.3.127 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than...

OpenJDK File TOCTOU deserialization vulnerability (6736390)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.225, and 1.3.127 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than...

OpenJDK File TOCTOU deserialization vulnerability (6736390)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.225, and 1.3.127 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than...

Low unzip security and bug fix update

5.51-9.EL4.5 - Resolves: 230558 problem in patch4 unzipped file permissions 5.51-8.EL4.5 - fix problem with 4GB files which are not compressed 5.51-7.EL4.5 - fix 164927 - TOCTOU issue in unzip - fix 178960 - unzip long filename buffer overflow - fix 199104 - add large file support return Lon's 4G...

Fedora Core 4 : unzip-5.51-13.fc4 (2006-098)

Mon Feb 6 2006 Ivana Varekova 5.51-13.fc4 - fix bug 178961 - CVE-2005-4667 - unzip long file name buffer overflow - Wed Aug 3 2005 Ivana Varekova 5.51-12.fc4 - fix bug 164928 - TOCTOU issue in unzip - Mon May 9 2005 Ivana Varekova 5.51-11 - fix bug 156959 invalid file mode on created files Note...

Fedora Core 3 : unzip-5.51-4.fc3 (2005-844)

This update fixes TOCTOU issue in unzip. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

GLSA-200507-22 : sandbox: Insecure temporary file handling

The remote host is affected by the vulnerability described in GLSA-200507-22 sandbox: Insecure temporary file handling The Gentoo Linux Security Audit Team discovered that the sandbox utility was vulnerable to multiple TOCTOU Time of Check, Time of Use file creation race conditions. Impact : Loca...