openMosixview: Insecure temporary file creation

Background The openMosixview package contains several tools used to manage openMosix clusters, including openMosixview the main monitoring and administration application and openMosixcollector a daemon collecting cluster and node information. Description Gangstuck and Psirac from Rexotec discover...

Mandrake Linux Security Advisory : cdrecord (MDKSA-2005:077)

Javier Fernandez-Sanguino Pena discovered that cdrecord created temporary files in an insecure manner if DEBUG was enabled in /etc/cdrecord/rscsi. If the default value was used which stored the debug output file in /tmp, a symbolic link attack could be used to create or overwrite arbitrary files...

[SECURITY] [DSA 661-2] New f2c packages fix insecure temporary files

-------------------------------------------------------------------------- Debian Security Advisory DSA 661-2 [email protected] http://www.debian.org/security/ Martin Schulze April 20th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 661-2] New f2c packages fix insecure temporary files

-------------------------------------------------------------------------- Debian Security Advisory DSA 661-2 [email protected] http://www.debian.org/security/ Martin Schulze April 20th, 2005 http://www.debian.org/security/faq -...

f2c fortran to c translator symbolic links problems

Symbolic links problem on temporary files creation...

[SECURITY] [DSA 661-2] New f2c packages fix insecure temporary files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 661-2 [email protected] http://www.debian.org/security/ Martin Schulze April 20th, 2005 http://www.debian.org/security/faq -...

DSA-661-2 f2c - insecure temporary files

Bulletin has no description...

CVE-2005-1119

Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files...

CVE-2005-0004

The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files...

CVE-2005-0991

RC.BOOT in IBM AIX 5.1, 5.2, and 5.3 does not "use a secure location for temporary files," which allows local users to have an unknown impact, probably by overwriting files...

sharutils: Insecure temporary file creation

Background sharutils is a collection of tools to deal with shar archives. Description Joey Hess has discovered that the program unshar, which is a part of sharutils, creates temporary files in a world-writable directory with predictable names. Impact A local attacker could create symbolic links i...

CVE-2005-0991: Undefined Security Weakness

RC.BOOT in IBM AIX 5.1, 5.2, and 5.3 does not "use a secure location for temporary files," which allows local users to have an unknown impact, probably by overwriting files...

sharutils -- unshar insecure temporary file creation

An Ubuntu Advisory reports: Joey Hess discovered that "unshar" created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program...

CVE-2005-0866

cdrecord before 4:2.0, when DEBUG is enabled, allows local users to overwrite arbitrary files via a symlink attack on temporary files...

OpenMosixView symbolic links problem

Unsafe temporary files handling...

USN-100-1: cdrecord vulnerability

Javier Fernández-Sanguino Peña noticed that cdrecord created temporary files in an insecure manner if DEBUG was enabled in /etc/cdrecord/rscsi. If the default value was used which stored the debug output file in /tmp, this could allow a symbolic link attack to create or overwrite arbitrary files...

security flaw

The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack...

Mandrake Linux Security Advisory : MySQL (MDKSA-2005:060)

A number of vulnerabilities were discovered by Stefano Di Paola in the MySQL server : If an authenticated user had INSERT privileges on the 'mysql' database, the CREATE FUNCTION command allowed that user to use libc functions to execute arbitrary code with the privileges of the user running the...

USN-96-1: mySQL vulnerabilities

Stefano Di Paola discovered three privilege escalation flaws in the MySQL server: - If an authenticated user had INSERT privileges on the 'mysql' administrative database, the CREATE FUNCTION command allowed that user to use libc functions to execute arbitrary code with the privileges of the...

CVE-2003-1099

shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a denial of service and possibly execute arbitrary code via a symlink attack...