CVE-2020-0003

CVE-2020-0003 affects Android 8.0 when the framework’s InstallStart.java onCreate contains a time‑of‑check time‑of‑use packaging validation bypass. The issue could allow a local elevation of privilege with user interaction required, via a vulnerability in the Android Framework. Public details ind...

PT-2020-11372 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions 8.0 Description: A time-of-check time-of-use vulnerability in the onCreate method of InstallStart.java could allow for a package validation bypass. This issue may lead to local escalation of privilege without requiring...

CVE-2013-4235

shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

DEBIAN-CVE-2013-4235

shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

Race condition

shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

DEBIAN-CVE-2015-7810

libbluray MountManager class has a time-of-check time-of-use TOCTOU race when expanding JAR files...

UBUNTU-CVE-2015-7810

libbluray MountManager class has a time-of-check time-of-use TOCTOU race when expanding JAR files...

Microsoft Windows splwow64 Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the user-mode...

QEMU Denial Of Service

include include include include include include include include include include include include include include include include include define diex do \ perrorx; \ exitEXITFAILURE; \ while0; // Constans define SRCADDR "10.0.2.15" define DSTADDR "10.0.2.2" define INTERFACE "ens3" define ETHHDRLEN ...

docker: symlink-exchange race attacks in docker cp

A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause arbitrary files on t...

UBUNTU-CVE-2019-7307

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users /.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on th...

PT-2019-4928 · Canonical · Apport +1

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.14.1-0ubuntu3.29+esm1 Apport versions prior to 2.20.1-0ubuntu2.19 Apport versions prior to 2.20.9-0ubuntu7.7 Apport versions prior to 2.20.10-0ubuntu27.1 Apport versions prior to 2.20.11-0ubuntu5 Description: The...

Race condition

A vulnerability in the Remote Package Manager RPM subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use TOCTOU race condition to corrupt local variables, which could lead to arbitrary command injectio...

GitLab: GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery

Summary The GitLab::UrlBlocker IP address validation methods suffer from a Time of Check to Time of Use ToCToU vulnerability. The vulnerability occurs due to multiple DNS resolution requests performed before and after the checks. This issue allows a malicious authenticated user to send GET and PO...

Splitting atoms in XNU

Posted by Ian Beer, Google Project Zero TL;DR A locking bug in the XNU virtual memory subsystem allowed violation of the preconditions required for the correctness of an optimized virtual memory operation. This was abused to create shared memory where it wasn't expected, allowing the creation of ...

VMware Workstation 14.x < 14.1.7 / 15.x < 15.0.4 Multiple Vulnerabilities (VMSA-2019-0005)

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.4 or 15.x prior to 15.0.1. It is, therefore, affected by multiple vulnerabilities, including: - An out-of-bounds read/write vulnerability and a Time-of-check Time-of-use TOCTOU vulnerability in the virtual USB 1....

devise Time-of-check Time-of-use Race Condition vulnerability

Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a time-of-check time-of-use TOCTOU race condition due to incrementfailedattempts within the Devise::Models::Lockable class not being concurrency safe...

CVE-2019-7347

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

Race condition

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

DEBIAN-CVE-2018-16872

A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...