CVE-2005-4772

liby2util in Yet another Setup Tool YaST in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote repository, which might allow local users to read or modify sensitive files, possibly giving local users the ability to exploit CVE-2005-3013...

SUSE-SA:2006:014: gpg

The remote host is missing the patch for the advisory SUSE-SA:2006:014 gpg. The GNU Privacy Guard GPG allows crafting a message which could check out correct using '--verify', but would extract a different, potentially malicious content when using '-o --batch'. The reason for this is that a .gpg ...

CVE-2006-0803

The signature verification functionality in the YaST Online Update YOU script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used...

Code injection

The signature verification functionality in the YaST Online Update YOU script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used...

CVE-2006-0803

The signature verification functionality in the YaST Online Update YOU script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used...

CVE-2006-0803

The CVE describes a flaw in YaST Online Update (YOU) signature verification: it relies on a GPG feature not intended for signature verification, preventing YOU from detecting malicious scripts that fail the signature check when using GPG 1.4.x. Affected component: YOU script; root cause: improper...

SUSE-SA:2006:009: gpg,liby2util

The remote host is missing the patch for the advisory SUSE-SA:2006:009 gpg,liby2util. With certain handcraftable signatures GPG was returning a 0 valid signature when used on command-line with option --verify. This only affects GPG version 1.4.x, so it only affects SUSE Linux 9.3 and 10.0. Other...

CVE-2005-4772

liby2util in Yet another Setup Tool YaST in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote repository, which might allow local users to read or modify sensitive files, possibly giving local users the ability to exploit CVE-2005-3013...

SUSE Security Announcement: pwdutils, shadow (SUSE-SA:2005:064)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUSE Security Announcement Package: pwdutils, shadow Announcement ID: SUSE-SA:2005:064 Date: Fri, 04 Nov 2005 14:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SuSE Linux 9.0 SuSE Linux Desktop 1.0 SuSE Lin...

SUSE-SA:2005:053: squid

The remote host is missing the patch for the advisory SUSE-SA:2005:053 squid. This update of the Squid web-proxy fixes two remotely exploitable denial of service vulnerabilities. One can be triggered by aborting a request CVE-2005-2794 due to a faulty assertion. The other one occurs in...

CVE-2005-3013

Buffer overflow in liby2util in Yet another Setup Tool YaST for SuSE Linux 9.3 allows local users to execute arbitrary code via a long Loc entry...

CVE-2005-3013

Buffer overflow in liby2util in Yet another Setup Tool YaST for SuSE Linux 9.3 allows local users to execute arbitrary code via a long Loc entry...

CVE-2005-3013

CVE-2005-3013 describes a buffer overflow in the liby2util component of YaST on SUSE Linux 9.3. The overflow is triggered by a long Loc entry and allows local users to execute arbitrary code. The vulnerability is local with low attack complexity and no authentication required, resulting in partia...

worring about YaST in SuSE 9.3 and maybe lower

author: l0om email: email:l0om | a7 | excluded d07 org page: www.excluded.org worring about YaST in SuSE 9.3 and maybe lower iam wondering about the installation routine from SuSE linux 9.3 and maybe some lower verisons. YaST is creating a directory named...

YaST packages management system weak permissions

/var/adm/YaST/InstSrcManager/ISCACHE0x0000000X/DATA/descr file is world writable. There is a buffer overflow on oversized package location while parsing this file...

CVE-2004-1895

CVE-2004-1895 affects YaST Online Update (YOU) in SuSE 8.2 and 9.0. The vulnerability enables local users to overwrite arbitrary files via a symlink attack on you-$USER/cookies, indicating a local, user-privilege escalation risk (no remote access). The available sources explicitly describe the is...

CVE-2004-1895

YaST Online Update YOU in SuSE 8.2 and 9.0 allows local users to overwrite arbitrary files via a symlink attack on you-$USER/cookies...

CVE-2004-1895

YaST Online Update YOU in SuSE 8.2 and 9.0 allows local users to overwrite arbitrary files via a symlink attack on you-$USER/cookies...

SuSE YaST symbolic links problem

Symbolic links problem with YOU/onlineupdate...

SuSEs YaST Online Update - possible symlink attack

author:l0om - l0omatexcluded.org - www.excluded.org date:05.04.2004 product:SuSE 9.0 maybe lower possible symlink attack in SuSEs YOU YaST Online Update in SuSE linux you can use YOU to auto update your system. you can do this by YaST or by hand with the command "onlineupdate". as a normal user y...