Linux news 20.11.00

Следующий шаг ядра стабильной ветки - 2.2.18pre22 Следующий шаг на пути к 2.2.19. Подробнее: http://linuxtoday.com/newsstory.php3?ltsn=2000-11-19-009-04-NW-KN Linux 2.4.0-test11 Вышло очередное тестовое ядро... Подробнее: ftp://ftp.kernel.org/pub/linux/kernel/v2.4/ AC Kernel Patch 2.2.x 2.2.18pre...

Linux news 1.11.00

Linux 2.2.18pre18 Alan Cox выпустил очередную pre-версию следующего стабильного ядра Linux: Linux 2.2.18pre18. Подробнее: http://linuxtoday.com/newsstory..php3?ltsn=2000-10-29-007-04-NW-KN Linux-2.4.0-test10-final Возможно последнее ядро в 2.4.0-test серии. Для релиза 2.4.0-stable ожидается...

CVE-2000-0481

Buffer overflow in KDE Kmail allows a remote attacker to cause a denial of service via an attachment with a long file name...

CVE-2000-0530

The CVE-2000-0530 entry describes a vulnerability in KDE 1.1.2 where the KApplication-class creates configuration files without proper ownership checks or existence verification. The result is a local privilege-attack risk: a local user can exploit a symlink/ownership flaw to overwrite arbitrary ...

CVE-2000-0530

The KApplication class in the KDE 1.1.2 configuration file management capability allows local users to overwrite arbitrary files...

CVE-2000-0481

CVE-2000-0481 describes a buffer overflow in KDE Kmail triggered by an attachment with a long file name, allowing a remote attacker to cause a denial of service. The NVD entry lists a Network-attack vector, low complexity, no authentication, with Availability impact described as Partial. The CVSS...

kvt format bug

kdebase-1.1.2 xsetup.c:229 displayname = getenv"DISPLAY"; command.c:1720 extern char displayname; command.c:1840 cprintfdisplayname; command.c:1464 void cprintfunsigned char fmt,... Patch attached. -- Carlos E Gorges [email protected] Tech informбtica LTDA Brazil...

Linux 2.2.17pre20 Вышла новая pre-версия следующего стабильного ядра Linux: 2.2.17pre20. Список изменений пока не попался мне на глаза. Подробнее: ftp://ftp.kernel.org/pub/linux/kernel/people/alan/2.2.17pre/ Linux-2.4.0-test7 Вышло новое "нестабильное" ядро Linux: Linux-2.4.0-test7. Подробнее:...

CVE-2000-0373

Vulnerabilities in the KDE kvt terminal program allow local users to gain root privileges...

CVE-2000-0393

The CVE-2000-0393 issue affects the KDE kscd program. It does not drop privileges when executing a program specified in a user’s SHELL environment variable, allowing a local user to gain privileges by directing kscd to run an alternate program. The description only states the vulnerability; it do...

CVE-2000-0373

Technical details about CVE-2000-0373 are not publicly available in the provided documents; the KDE kvt vulnerability is noted, but specifics (affected versions, root cause, remediation) are not disclosed here. Monitor for official updates.

CVE-2000-0393

The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, which allows the user to gain privileges by specifying an alternate program to execute...

CVE-2000-0460

Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable...

CVE-2000-0460

CVE-2000-0460 affects KDE kdesud on Linux and is a local privilege-escalation vulnerability caused by a buffer overflow triggered by a long DISPLAY environment variable. The NVD metrics indicate Local attack vector, Low attack complexity, no authentication required, and a base score of 7.2 (HIGH)...

CVE-2000-0371

Technical details for CVE-2000-0371 are not publicly available in the provided documents. The materials here reiterate that the libmediatool library used by KDE mediatool can allow local symlink-based file creation. Monitor for updates.

Linux news 16.06.00

SCO планирует выпускать свой собственный дистрибутив Linux. По-моему сейчас не делает свои дистрибутивы Linux только ленивый. Лучше бы был один, но отличный. Подробнее: http://slashdot.org/articles/00/06/13/127228.shtml Интервью с Аланом Коксом На LinuxJournal выложено интервью с одним из главных...

Очередная дырка в KDE

Класс KApplication некорректно работает с конфиуграционными файлами не проверяются символьные линки, что позволяет атаковать любое приложение, использующее данный класс например ktvision и ktuner...

KDE::KApplication feature?

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------ TESO Security Advisory 2000/05/29 KDE KApplication configfile vulnerability Summary =================== A bug within the KDE configuration-file management has been discovered. Due to insecure creation of configuration files via...

CVE-2000-0530

The KApplication class in the KDE 1.1.2 configuration file management capability allows local users to overwrite arbitrary files...

KDE 1.1.2 KApplication configfile - Local Privilege Escalation (2)

KDE 1.1.2 KApplication configfile - Local Privilege Escalation 2 source: https://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can...