CVE-1999-1341

Linux kernel before 2.3.18 or 2.2.13pre15, with SLIP and PPP options, allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices...

CVE-1999-0720

The ptchown command in Linux allows local users to modify TTY terminal devices that belong to other users...

GNU glibc 2.12.1.1 -6 - pt_chown Local Privilege Escalation

GNU glibc 2.12.1.1 -6 - ptchown Local Privilege Escalation // source: https://www.securityfocus.com/bid/597/info // ptchown is a program included with glibc 2.1.x that exists to aid the proper allocation of terminals for non-suid programs that don't have devpts support. It is installed setuid roo...

GNU glibc 2.1/2.1.1 -6 - 'pt_chown' Local Privilege Escalation

// source: https://www.securityfocus.com/bid/597/info // ptchown is a program included with glibc 2.1.x that exists to aid the proper allocation of terminals for non-suid programs that don't have devpts support. It is installed setuid root, and is shipped with RedHat Linux 6.0. As it stands,...

midnight-commander-tty.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice More kernel 'things' - tty allocation ------------------------------------- Hmm, I've posted it months ago, and I have no idea why it hasn't been approve...

CVE-2000-0365

Red Hat Linux 6.0 installs the /dev/pts file system with insecure modes, which allows local users to write to other tty devices...

CVE-2000-0364

screen and rxvt in Red Hat Linux 6.0 do not properly set the modes of tty devices, which allows local users to write to other ttys...

Solaris 7.0 - 'ufsdump' Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/680/info A buffer overflow vulnerability in the /usr/lib/fs/ufs/ufsdump setuid program allows local users to obtain root and tty group access. The vulnerability is the result of 'ufsdump' not being able to handle device names of a large length. / ufodu...

DEBIAN-CVE-2023-53805

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: fix UAF in gsmcleanupmux In gsmcleanupmux the 'gsm-dlci' pointer was not cleaned properly, leaving it a dangling pointer after gsmdlcirelease. This leads to use-after-free where 'gsm-dlci0' are freed and accessed by th...