The vulnerability of the PHP interpreter, allowing a hacker to modify arbitrary files

The vulnerability of the PharData PHP interpreter relates to deficiencies in pathname restrictions for directories. Exploiting this vulnerability allows an attacker to modify arbitrary files by adding the symbol “..” to the pathname of the ZIP archive during the extractTo operation...

PT-2016-1755

Name of the Vulnerable Software and Affected Versions EMC Unisphere for VMAX Virtual Appliance versions prior to 8.2.0 Description The issue is related to an HTTP servlet in the vApp Manager component, which lacks sufficient input validation. This allows remote attackers to modify arbitrary files...

VMware ESX / ESXi Arbitrary File Modification (VMSA-2013-0016) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by an arbitrary file modification vulnerability due to improper handling of certain Virtual Machine file descriptors. A local attacker can exploit this to read or modify arbitrary files. C Tenable...

CVE-2015-8660: Undefined Security Weakness

The ovlsetattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application...

PT-2015-3303

Name of the Vulnerable Software and Affected Versions GNU Patch versions prior to 2.7.3 Description The issue is related to a directory traversal vulnerability in GNU Patch, which affects versions that support Git-style patching. This vulnerability can be exploited by a remote attacker to modify...

QNX RTOS 4.25 monitor Arbitrary File Modification Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4902/info The QNX RTOS monitor utility is prone to an issue which may allow local attackers to modify arbitrary system files such as /etc/passwd. monitor is installed setuid root by default. The monitor -f command line...

OpenVMS 5.3/6.2/7.x UCX POP Server Arbitrary File Modification Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5790/info An issue with the UCX POP Post Office Protocol server used by OpenVMS has been reported. It is possible for a malicous local user to overwrite arbitrary files on the filesystem by exploiting a vulnerability in t...

QNX RTOS 4.25 dumper Arbitrary File Modification Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4904/info When creating memory dump files, the QNX RTOS debugging utility 'dumper' follows symbolic links. It also sets ownership of the file to the userid of the terminated process. It is possible for malicious local...

Mandriva Linux Security Advisory : python-imaging (MDVSA-2014:082)

Updated python-imaging packages fix security vulnerabilities : Jakub Wilk discovered that temporary files were insecurely created via mktemp in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to...

CVE-2014-1934

tag.py in eyeD3 aka python-eyed3 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file...

CVE-2014-1934: Improper Link Resolution Before File Access

tag.py in eyeD3 aka python-eyed3 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file...

CVE-2011-4406: Undefined Security Weakness

The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors...

CVE-2001-1593

Jakub Wilk found that a2ps, a tool to convert text and other types of files to PostScript, insecurely used a temporary file in spyuser. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running a2ps...

CVE-2001-1593: Improper Link Resolution Before File Access

The tempnameensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spyuser function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file...

MGASA-2014-0159 Updated python-pillow packages fix insecure use of temporary files

Updated python-imaging packages fix security vulnerabilities: Jakub Wilk discovered that temporary files were insecurely created via mktemp in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perfo...

CVE-2014-0899: Undefined Security Weakness

ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition aka WPAR for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands...

PT-2014-3805

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions prior to 10.01 Description The certificate-import feature in the Certificate Authority Proxy Function CAPF CLI implementation has an issue that allows local users to read or modify arbitrary files...

PT-2014-3806

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager Unified CM versions 10.01 and earlier Description The issue allows local users to read or modify arbitrary files. Recommendations For versions 10.01 and earlier, update to a version later than 10.01 to...

MGASA-2014-0089 Updated python-numpy packages fix security vulnerabilities

f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859...

CVE-2014-1833: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink...