57 matches found
CVE-2018-16872
A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...
CVE-2018-16872
A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...
CVE-2018-16872
A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...
CVE-2018-16872
CVE-2018-16872 describes a TOCTTOU vulnerability in QEMU’s Media Transfer Protocol (MTP) handling. The code paths usb_mtp_get_object, usb_mtp_get_partial_object and usb_mtp_object_readdir don’t account for filesystem changes since the time of lstat(2) in usb_mtp_object_alloc, allowing an attacker...
CVE-2018-16872
A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...
UBUNTU-CVE-2018-16872
A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...
Windows Kernel double fetches in win32kfull!xxxImeWindowPosChanged and win32kfull!InternalRebuildHwndListForIMEClass( CVE-2018-0809)
We have noticed the following code in the win32kfull!xxxImeWindowPosChanged function on Windows 10 version 1709 32-bit listing from the IDA Pro disassembler: .text:000485A4 ; try // except at locF3502 .text:000485A4 mov ebp+msexc.registration.TryLevel, 0 .text:000485AB mov eax, ecx .text:000485AD...
Debian: Security Advisory (DLA-978-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-978-1 : perl security update
The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw to set the mode on an attacker-chosen file to an attacker-chosen value. For Debian 7...
Debian DSA-3873-1 : perl - security update
The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw to set the mode on an attacker-chosen file to a attacker-chosen value. %NASLMINLEVEL...
[SECURITY] [DLA 978-1] perl security update
Package : perl Version : 5.14.2-21+deb7u5 CVE ID : CVE-2017-6512 Debian Bug : 863870 The cPanel Security Team reported a time of check to time of use TOCTTOU race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw...
[SECURITY] [DSA 3873-1] perl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3873-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 05, 2017 https://www.debian.org/security/faq -...
[SECURITY] [DSA 3873-1] perl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3873-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 05, 2017 https://www.debian.org/security/faq -...
shopify-scripts: Null pointer dereference due to TOCTTOU bug in mrb_time_initialize
mrbtimeinitialize sets the data pointer to NULL before parsing function arguments. Parsing function arguments can call out to ruby code to call methods to do type coercion. If the type coercion method tries to access the time object it will dereference a NULL pointer. The following snippet result...
shopify-scripts: TOCTTOU bug in mrb_str_setbyte leading the memory corruption
The Stringsetbyte function caches the length of the string before loading the function arguments. Loading function arguments through mrbgetargs can call into ruby code to run type conversion methods toi, tos and the like. A malicious conversion method is able to force the string to be reallocated...
Debian DSA-3659-1 : linux - security update
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. - CVE-2016-5696 Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan Dao, and Srikanth V. Krishnamurthy of the University of California, Riverside; and Lisa M...
