[oss-security] CVE-2014-4943: Linux privilege escalation in ppp over l2tp sockets

CVE-2014-4943 is a flaw in the Linux kernel allowing an unprivileged user to escalate to kernel privilege when CONFIGPPPOL2TP is enabled. If built as a module, a work-around to limit this to just the root user would be to add this to /etc/modprobe.conf: alias pppox-proto-1 off blacklist l2tpppp...

FreeBSD : phpMyAdmin -- multiple XSS vulnerabilities, missing validation (3f09ca29-0e48-11e4-b17a-6805ca0b3d42)

The phpMyAdmin development team reports : Self-XSS due to unescaped HTML output in database structure page. With a crafted table comment, it is possible to trigger an XSS in database structure page. Self-XSS due to unescaped HTML output in database triggers page. When navigating into the database...

phpMyAdmin -- multiple XSS vulnerabilities, missing validation

The phpMyAdmin development team reports: Self-XSS due to unescaped HTML output in database structure page. With a crafted table comment, it is possible to trigger an XSS in database structure page. Self-XSS due to unescaped HTML output in database triggers page. When navigating into the database...

Access for an unprivileged user to MySQL user list.

PMASA-2014-7 Announcement-ID: PMASA-2014-7 Date: 2014-07-17 Summary Access for an unprivileged user to MySQL user list. Description An unpriviledged user could view the MySQL user list and manipulate the tabs displayed in phpMyAdmin for them. Severity We consider this vulnerability to be non...

unbreakable enterprise kernel security update

2.6.39-400.215.4 - l2tp: fix an unprivileged user to kernel privilege escalation Sasha Levin Orabug: 19229505 CVE-2014-4943 CVE-2014-4943 - ptrace,x86: force IRET path after a ptracestop Tejun Heo Orabug: 19230690 CVE-2014-4699...

Microsoft Internet Explorer CVE-2014-2790 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet explorer ...

FreeBSD -- Kernel memory disclosure in control messages and SCTP

Problem Description: Buffer between control message header and data may not be completely initialized before being copied to userland. CVE-2014-3952 Three SCTP cmsgs, SCTPSNDRCV, SCTPEXTRCV and SCTPRCVINFO, have implicit padding that may not be completely initialized before being copied to...

Microsoft Windows Journal File Processing CVE-2014-1824 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Avaya Au...

Microsoft Internet Explorer CVE-2014-2792 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet explorer...

Red Hat Linux stickiness of /tmp

No description provided by source. from: http://marc.info/?l=full-disclosure&m=129842239022495&w=2 Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora...

Shareplex 2.1.3 .9/2.2.2 beta Arbitary Local File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2535/info Shareplex is a database replication tool from Quest Software. Versions of the product contain a vulnerability which can permit local unprivileged users to read arbitrary files. The Qview component of Shareplex...

LPPlus 3.2.2/3.3 dccscan unprivileged read vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1644/info $LPHOME/bin/dccscan is suid-root and can be executed by any user. It is possible for an unprivileged user to print files to which he does not have read access. In testing, this works even for printers to which t...

Apple Mac OS X 10.x FPathConf System Call Local Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20982/info Apple Mac OS X is prone to a local denial-of-service vulnerability because the kernel fails to properly handle the execution of a system call. Exploiting this issue allows local, unprivileged users to crash...

Microsoft Windows win32k!GreStretchBltInternal() Does Not Handle src == dest

No description provided by source. Microsoft Windows win32k!GreStretchBltInternal does not handle src == dest ---------------------------------------------------------------------------- A bitblt bit block transfer is used to copy one rectangular region of screen to another, often performing a...

QNX 6.x 'ptrace()' Arbitrary Process Modification Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4919/info The QNX implementation of 'ptrace' is reportedly insecure. An unprivileged process may attach to a setuid program without restriction. Since the attaching process may view or edit memory, an attacker may exploit...

HP Tru64 Alpha OSF1 5.1 - (ps) Information Leak Exploit

No description provided by source. !/bin/ksh osf1tru64ps.ksh exploit Tested on OSF1 V5.1 1885 alpha ps executable - information leak Author: Andrea bunker Purificato http://rawlab.mindcreations.com the ps command also /usr/ucb/ps on HP OSF1 v5.1 Alpha, developed without an eye to security, allows...

MS Windows 2000 Debug Registers Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2764/info A vulnerability exists in the handling of debug registers in Windows 2000. It is possible for unprivileged processes to create breakpoints for arbitrary processes. This can be used to 'kill' arbitrary processes...

IRIX 6.2/6.3/6.4 xfs truncate() Privilege Check Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1540/info The truncate system call on a number of versions of the IRIX operating system with the xfs file system does not properly check permissions before truncating a file, making it possible for unprivileged users to...

SAP DB 7.3 .00 Symbolic Link Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6316/info A vulnerability has been discovered in SAP DB that may allow an unprivileged to execute commands with root privileges. The vulnerability is due to insufficient sanity checks by lserver, when attempting to execut...

Multiple D-Link Router Models Authentication Bypass Vulnerability

No description provided by source. Exploit Title: Multiple D-Link Router Authentication Bypass Vulnerabilities Date: 12-01-2011 Author: Craig Heffner, /dev/ttyS0 Firmware Link: http://www.dlink.co.uk/ Firmware Versions: All Tested on: DIR-300, DIR-320, DIR-615 revD Multiple D-Link routers that us...