Fedora 18 : glibc-2.16-34.fc18 (2013-15072)

glibc security update : CVE-2013-2207 glibc ptchown: Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal The fix may break chroots if their devpts was not mounted correctly. Fix is to mount the devpts correctly with gid=5. Note that Tenable Networ...

Fedora 19 : glibc-2.17-13.fc19 (2013-15053)

glibc security update : CVE-2012-4412 glibc: strcoll integer overflow leading to buffer overflow CVE-2012-4424 glibc: alloca stack overflow in the strcoll interface CVE-2013-1914 glibc: Stack frame overflow in getaddrinfo when processing entry mapping to long list of address structures...

Apache suEXEC Privilege Elevation / Information Disclosure

Apache suEXEC suffers from privilege escalation and information disclosure vulnerabilities. Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the...

CVE-2013-4953

SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter...

Sql injection

SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter...

PT-2013-5301

Name of the Vulnerable Software and Affected Versions Top Games Script version 1.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the gid parameter in the play.php file. Recommendations For version 1.2, avoid using the gid parameter in the...

CVE-2013-4953: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter...

Oracle Linux 6 : cifs-utils (ELSA-2012-0902)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0902 advisory. 4.8.1-10 - mount.cifs: don't allow unprivileged users to mount onto dirs they can't chdir into bz 812782 4.8.1-9 - cifs.upcall: use krb5snametoprincipal to...

CVE-2013-1979

The scmsetcred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application...

DEBIAN-CVE-2013-1959

kernel/usernamespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uidmap and gidmap files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process...

CVE-2013-1979: Undefined Security Weakness

The scmsetcred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application...

UBUNTU-CVE-2013-1959

kernel/usernamespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uidmap and gidmap files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process...

PT-2013-3492 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.8.9 Description: The issue concerns a lack of appropriate capability requirements for the uid map and gid map files in the Linux kernel. This allows local users to potentially gain privileges by opening a file...

ClipShare 4.1.1 - gid Blind SQL Injection

ClipShare 4.1.1 - gid Blind SQL Injection Exploit Title: ClipShare 4.1.1 gmembers.php Blind SQL Injection Vulnerability Exploit Author: Esac Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4 Official site: http://www.clip-share.com Software License: Commercial. all versions ar...

PT-2013-1100 · Debian +2 · Debian +2

Name of the Vulnerable Software and Affected Versions: Debian GNU/Linux versions prior to 3.8.11 Linux kernel versions prior to 3.8.11 Description: The issue concerns multiple vulnerabilities in the Linux package of the Debian GNU/Linux operating system, which can be exploited by a local attacker...

AIX 6.1 TL 1 : swcons (IZ28943)

A file permission/ownership vulnerability exists in the 'bos.rte.console' fileset command listed below whereby a local attacker may create arbitrary contents within a file owned by root using the 'swcons' command. The local attacker must be a member of the 'system' group gid=0 to execute this...

CVE-2012-3317

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...

PT-2012-4648

Name of the Vulnerable Software and Affected Versions IBM WebSphere Message Broker versions 6.1 through 6.1.0.10 IBM WebSphere Message Broker versions 7.0 through 7.0.0.4 IBM WebSphere Message Broker versions 8.0 through 8.0.0.1 Description The issue is related to incorrect ownership of certain...

CVE-2012-3317: Undefined Security Weakness

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...

CVE-2012-4443: Undefined Security Weakness

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...