jboss: jbossas writable config files allow privilege escalation

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group root:jboss, 664. On systems using classic /etc/init.d init scripts i.e. on Red Hat Enterprise Linux 6 a...

[SECURITY] Fedora 26 Update: cloud-init-0.7.9-4.fc26

Cloud-init is a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install ssh keys and to let the user run various scripts...

DEBIAN-CVE-2017-7178

CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves 1 hosting a crafted plugin that executes an arbitrary program from its init.py file and 2 causing the victim to download, install, and enable this plugin...

SUSE SLED12 / SLES12 Security Update : open-vm-tools (SUSE-SU-2017:0702-1)

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues : - New vmware-namespace-cmd command line utility - GTK3 support - Common Agent Framework CAF - Guest authentication with xmlsec1 - Sub-command to push updated network information to the host on demand ...

SUSE SLED12 / SLES12 Security Update : open-vm-tools (SUSE-SU-2017:0701-1)

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues : - New vmware-namespace-cmd command line utility - GTK3 support - Common Agent Framework CAF - Guest authentication with xmlsec1 - Sub-command to push updated network information to the host on demand ...

PT-2017-16813

Name of the Vulnerable Software and Affected Versions virglrenderer versions prior to 0.6.0 Description The issue is related to a memory leak in the vrend renderer init blit ctx function, located in vrend blitter.c. This leak can be triggered by local guest OS users, allowing them to cause a deni...

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation...

tomcat: tomcat writable config files allow privilege escalation

It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges...

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation...

PT-2017-7772

Name of the Vulnerable Software and Affected Versions Hesiod version 3.2.1 Description The issue allows local users to gain privileges by leveraging certain SUID/SGUID binary, using the HESIOD CONFIG or HES DOMAIN environment variables. This is due to the hesiod init function comparing EUID with...

UBUNTU-CVE-2016-7392

Heap-based buffer overflow in the pstoeditsuffixtableinit function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service out-of-bounds write via a crafted bmp image file...

CVE-2016-10089

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641...

CVE-2016-10089

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641...

Hardcoded credentials

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641...

CVE-2016-10089: Undefined Security Weakness

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641...

PT-2017-7726

Name of the Vulnerable Software and Affected Versions Nagios versions 4.3.2 and earlier Description The issue allows local users to gain root privileges via a hard link attack on the Nagios init script file. Recommendations For Nagios versions 4.3.2 and earlier, update to a version later than 4.3...

DEBIAN-CVE-2016-4797

Divide-by-zero vulnerability in the opjtcdinittile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service application crash via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947...

UBUNTU-CVE-2016-4797

Divide-by-zero vulnerability in the opjtcdinittile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service application crash via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947...

jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation

It was discovered that the jboss init script performed unsafe file handling which could result in local privilege escalation...

jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation

It was discovered that the jboss init script performed unsafe file handling which could result in local privilege escalation...