qemu: when started as root, extra groups are not dropped correctly

Cause: qemu did not properly drop extra group privileges when started as root with the -runas commandline option. Consequence: extra GID's would give qemu elevated privileges to read or write files that the supplementary groups allowed, because qemu is still running with group root privileges. Fi...

CVE-2011-3875

Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors...

CVE-2011-3875

Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors...

CVE-2011-3875

Removed by vendor...

CVE-2011-3980

Technical details about CVE-2011-3980 are not publicly provided in the connected documents. The materials reference TYPO3 Drag Drop Mass Upload extension 2.0.2 and earlier and arbitrary file upload, but do not specify vectors or root cause. Monitor for updates.

jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload GRO implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization RHEV Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

Code injection

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2984

Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

Design/Logic Flaw

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Google Chrome on Linux (pre-13.0.782.107) is affected by CVE-2011-2782 due to a drag-and-drop file permission handling flaw that could allow a user‑assisted remote attacker to bypass access restrictions via unspecified vectors. The issue is addressed in Chrome 13.0.782.107 (Stable Channel update)...

CVE-2011-2782

The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2011-2782

Removed by vendor...

kernel: net: Fix memory leak/corruption on VLAN GRO_DROP

The Generic Receive Offload GRO implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization RHEV Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

Spam Profits Down, Cybercrooks Flock to Targeted Attacks

HED: Report: Spam Profits Down, Cybercrooks Flock to Targeted Attacks DEK: A report from Cisco Systems suggests that cybercriminals are abandoning spamming for targeted attacks, which are more profitable. A new report from Cisco Systems Inc. analyzing illegal activities from spammers and other...