3627 matches found
CVE-2016-10044
CVE-2016-10044 is supported by connected advisories: the Linux kernel up to version 4.7.7 contains a vulnerability in the aio_mount path. Specifically, the aio_mount function in fs/aio.c did not properly restrict execute access, enabling local users to bypass SELinux W^X policy and gain privilege...
CVE-2016-10044: Undefined Security Weakness
The aiomount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an iosetup system call...
CVE-2017-5551
The simplesetacl function in fs/posixacl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOT...
CVE-2016-10154
CVE-2016-10154 affects Linux kernel 4.9.x prior to 4.9.1. The smbhash function in fs/cifs/smbencrypt.c interacts incorrectly with CONFIG_VMAP_STACK, enabling local users to trigger a denial of service (system crash or memory corruption) or other unspecified impacts by exploiting use of more than ...
PT-2017-7773
Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.9.x before 4.9.1 Description The issue is related to the smbhash function in fs/cifs/smbencrypt.c, which interacts incorrectly with the CONFIG VMAP STACK option. This can allow local users to cause a denial of service,...
CVE-2017-5551: Undefined Security Weakness
The simplesetacl function in fs/posixacl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOT...
CVE-2016-10208: Out-of-bounds Read
The ext4fillsuper function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service out-of-bounds read and system crash via a crafted ext4 image...
PT-2017-3589
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.11 Description: The issue is related to a NULL pointer dereference in the setup ntlmv2 rsp function, located in fs/cifs/cifsencrypt.c. This occurs when an empty TargetInfo field in an NTLMSSP setup negotiation...
GLSA-201701-73 : SQUASHFS: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201701-73 SQUASHFS: Multiple vulnerabilities Multiple vulnerabilities have been discovered in SQUASHFS. Please review the CVE identifiers referenced below for details. Impact : Remote attackers, by enticing a user to process a...
DEBIAN-CVE-2016-10156
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...
CVE-2016-10156
The CVE-2016-10156 issue affects systemd v228, where a flaw in /src/basic/fs-util.c caused world-writable SUID files to be created via systemd timers. This could allow a local attacker to escalate privileges to root. The vulnerability is fixed in systemd v229, and multiple advisories (SUSE/SLES o...
CVE-2016-10156
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...
CVE-2016-10156: Undefined Security Weakness
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229...
PT-2019-7539
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.3 Description The issue is related to a race condition between direct and memory-mapped I/O in the Linux kernel, specifically in the fs/xfs/xfs aops.c file. This condition can be exploited by local users to...
kernel security, bug fix, and enhancement update
3.10.0-514.6.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-514.6.1 - net sctp: validate chunk len before actually using it Hangbin Liu...
kernel security and bug fix update
2.6.32-642.13.1 - net Fix use after free in the recvmmsg exit path Davide Caratti 1390805 1390046 CVE-2016-7117 - net vlan: Propagate MAC address to VLANs Jarod Wilson 1396479 1381585 - net tcp: fix use after free in tcpxmitretransmitqueue Mateusz Guzik 1379527 1379529 CVE-2016-6828 - net...
wordpress plugin fs-shopping-cart cross-site scripting vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin fs-shopping-cart, which allows attackers to frame malicio...
e2fsprogs: Heap-based buffer overflow
Background e2fsprogs is a set of utilities for maintaining the ext2, ext3 and ext4 file systems. Description A heap-based buffer overflow was discovered in openfs.c in the libext2fs library in e2fsprogs. Impact A remote attacker could entice a user to use ext2fs library for example, fsck on a...
CVE-2016-6213
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service memory consumption and deadlock via MSBIND mount system calls, as demonstrated by a loop that triggers exponential growth in the...