openssh -- command injection when X11Forwarding is enabled

The OpenSSH project reports: Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth1. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege, Other xauth comman...

openssh: command injection

Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege. Other xauth commands allow limited information...

MGASA-2016-0108 Updated openssh packages fix security vulnerability

Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth1 CVE-2016-3115...

PT-2016-1518

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.2p2 Description The issue allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the do authenticated1 and session x11 req functions. This is due ...

DropBearSSHD 2015.71 - Command Injection

Exploit for linux platform in category remote exploits VuNote ============ Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3116 Version: 0.2 Date: Mar 3rd, 2016 Tag: dropbearsshd xauth command injection may lead to forced-command bypass Overview -------- Name: dropbear...

[SECURITY] Fedora 22 Update: gsi-openssh-6.9p1-7.fc22

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

[SECURITY] Fedora 23 Update: gsi-openssh-7.1p2-1.fc23

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

xWPE 1.5.30a-2.1 - Local Buffer Overflow

Exploit Author: Juan Sacco - http://www.exploitpack.com Program: xwpe - Windows Editor v1.5.30a-2.1 Description: Programming environment and editor for console and X11 Tested and developed on: Kali Linux 2.0 x86 - https://www.kali.org Description: xwpe v1.5.30a-2.1 and prior is prone to a...

xWPE 1.5.30a-2.1 - Local Buffer Overflow

Exploit for linux platform in category local exploits Program: xwpe - Windows Editor v1.5.30a-2.1 Description: Programming environment and editor for console and X11 Tested and developed on: Kali Linux 2.0 x86 - https://www.kali.org Description: xwpe v1.5.30a-2.1 and prior is prone to a stack-bas...

xwpe 1.5.30a-2.1 Buffer Overflow

Exploit Author: Juan Sacco - http://www.exploitpack.com Program: xwpe - Windows Editor v1.5.30a-2.1 Description: Programming environment and editor for console and X11 Tested and developed on: Kali Linux 2.0 x86 - https://www.kali.org Description: xwpe v1.5.30a-2.1 and prior is prone to a...

[SECURITY] Fedora 22 Update: openssh-6.9p1-10.fc22

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues ...

PT-2016-3110

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.2 Description The issue is related to errors in security settings of the OpenSSH client, specifically with the handling of failed cookie generation for untrusted X11 forwarding. This allows a remote attacker to obta...

Debian Security Advisory DSA 3438-1 (xscreensaver - security update)

It was discovered that unplugging one of the monitors in a multi-monitor setup can cause xscreensaver to crash. Someone with physical access to a machine could use this problem to bypass a locked session. OpenVAS Vulnerability Test $Id: deb3438.nasl 6608 2017-07-07 12:05:05Z cfischer $...

SUSE-RU-2015:2393-1 Recommended update for xorg-x11-libs

This update for xorg-x11-libs fixes the following issues: - The original fix for CVE-2015-1804 prevented DWIDTH to be negative. However, the spec states that 'DWIDTH ... is a vector indicating the position of the next glyph's origin relative to the origin of this glyph'. Consequently, negative...

X.Org X11 服务器模块释放后重用漏洞

No description provided by source...

Google Chrome - Renderer Process to Browser Process Privilege Escalation

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=664 There is an overflow in the ui::PlatformCursor WebCursor::GetPlatformCursor method. In src/content/common/cursors/webcursoraurax11.cc&q=webcursoraurax11.cc, there is...

Google Chrome - Renderer Process to Browser Process Privilege Escalation

Google Chrome - Renderer Process to Browser Process Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=664 There is an overflow in the ui::PlatformCursor WebCursor::GetPlatformCursor method. In...

[SECURITY] Fedora 22 Update: sddm-0.12.0-5.fc22

SDDM is a modern display manager for X11 aiming to be fast, simple and beautiful. It uses modern technologies like QtQuick, which in turn gives the designer the ability to create smooth, animated user interfaces...

CVE-2015-7244

The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets...