SUSE-SU-2017:1335-1 Security update for kdelibs4

This update for kdelibs4 fixes the following issues: - CVE-2017-8422: This update fixes problem in the DBUS authentication of the kauth framework that could be used to escalate privileges depending on bugs or misimplemented dbus services. boo1036244...

KDE 4/5 - 'KAuth' Local Privilege Escalation

// cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include include include include include include void dieconst char...

Design/Logic Flaw

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service...

CVE-2017-8849

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service...

CVE-2017-8849

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service...

CVE-2017-8849

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service...

Debian DSA-3849-1 : kde4libs - security update

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2017-6410 Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not...

FreeBSD : kauth: Local privilege escalation (0baee383-356c-11e7-b9a9-50e549ebab6c)

Albert Astals Cid reports : KAuth contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account. %NASLMINLEVEL 70300 C Tenable Network...

kauth: Local privilege escalation

Albert Astals Cid reports: KAuth contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account...

[ASA-201705-12] kauth: privilege escalation

Arch Linux Security Advisory ASA-201705-12 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kauth Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-269 Summary ======= The package kauth before version...

[ASA-201705-13] kdelibs: privilege escalation

Arch Linux Security Advisory ASA-201705-13 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kdelibs Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-270 Summary ======= The package kdelibs before version...

CVE-2017-2663

It was found that subscription-manager's DBus interface let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack...

SUSE SLED12 / SLES12 Security Update : Recommended update for dbus-1 (SUSE-SU-2017:0695-1)

This update for dbus-1 fixes the following issues: Security issues fixed : - Symlink attack in nonce-tcp transport. bsc1025950 - Symlink attack in unit tests. bsc1025951 Bugfixes : - Remove sysvinit script, not used under systemd. bsc974092 Note that Tenable Network Security has extracted the...

SUSE-SU-2017:0695-1 Recommended update for dbus-1

This update for dbus-1 fixes the following issues: Security issues fixed: - Symlink attack in nonce-tcp transport. bsc1025950 - Symlink attack in unit tests. bsc1025951 Bugfixes: - Remove sysvinit script, not used under systemd. bsc974092...

SUSE SLED12 / SLES12 Security Update : dbus-1 (SUSE-SU-2017:0292-1)

This update for dbus-1 to version 1.8.22 fixes one security issue and bugs. The following security issue was fixed : - bsc1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. The following upstream changes are included : - Change the default...

SUSE-SU-2017:0292-1 Security update for dbus-1

This update for dbus-1 to version 1.8.22 fixes one security issue and bugs. The following security issue was fixed: - bsc1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. The following upstream changes are included: - Change the default...

USN-3116-1: DBus vulnerabilities | Cloud Foundry

USN-3116-1: DBus vulnerabilities Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that DBus incorrectly validated the source of Activation Failure signals. A local attacker could use this issue to cause a denial of service. This issue only...

Fedora Update for dbus FEDORA-2016-c1bb366e5b

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for dbus FEDORA-2016-0a4dc821d5

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3116-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...