CVE-2011-1675

mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMITFSIZE value, a related issue to CVE-2011-1089...

CVE-2011-1678

smbfs in Samba 3.5.8 and earlier attempts to use 1 mount.cifs to append to the /etc/mtab file and 2 umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process wi...

CVE-2011-1675

mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMITFSIZE value, a related issue to CVE-2011-1089...

UBUNTU-CVE-2011-1675

mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMITFSIZE value, a related issue to CVE-2011-1089...

quagga: BGP session reset by processing BGP Update message with malformed AS-path attributes

bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service session reset via a malformed ASPATHLIMIT path attribute...

Profile picture thumbnail generation can consume unlimited amount of memory

Discovered a Studio customer, you can upload a very large profile picture to expose the same problem as CONF-21480, just in a different area of the application. We should limit the size of images we're willing to load into memory to avoid this problem with user pictures...

Profile picture thumbnail generation can consume unlimited amount of memory

Discovered a Studio customer, you can upload a very large profile picture to expose the same problem as CONF-21480, just in a different area of the application. We should limit the size of images we're willing to load into memory to avoid this problem with user pictures...

boblog arbitrary variable overwrite vulnerability(a)-vulnerability warning-the black bar safety net

by Ryatpuretot mail: puretot at gmail dot com team: http://www.80vul.com Vulnerability code is as follows: // go.php $qurl=$SERVER"REQUESTURI"; @list$relativePath, $rawURL=@explode'/go.php/', $qurl; $rewritedURL=$rawURL; // from$SERVER"REQUESTURI",can be arbitrarily submitted:...

kernel security and bug fix update

2.6.18-238.5.1.0.1.el5 - scsi fix scsi hotplug and rescan race orabug 10260172 - fix filpclose race Joe Jin orabug 10335998 - fix missing aiocomplete in endio Joel Becker orabug 10365195 - make xenkbd.abspointer=1 by default orabug 67188919 - xen check to see if hypervisor supports memory...

quake3-master-getservers NSE Script

Queries Quake3-style master servers for game servers many games other than Quake 3 use this same protocol. Script Arguments quake3-master-getservers.outputlimit If set, limits the amount of hosts returned by the script. All discovered hosts are still stored in the registry for other scripts to us...

CVE-2011-0448

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument...

PT-2011-2351 · Ruby +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 3.0.x through 3.0.3 Description: The issue allows remote attackers to conduct SQL injection attacks via a non-numeric argument to the limit function, as it does not ensure that arguments specify integer values...

Chi Sepang international series system to kill exploit 0day and fix-vulnerability warning-the black bar safety net

Chi Sepang international series system to kill exploit 0day and fix Brief description: this vulnerability should be a series system to kill, in the background Annex to the upload not the file format limit, can lead to upload any type of file. Use method: can be utilized where there are two, one i...

A wine industry network member registration upload vulnerability-vulnerability warning-the black bar safety net

Publishing author: xiaokis Vulnerability type: file upload Vulnerability description: File: subupload. asp 0 1 !-- include file="UPLOAD. INC"-- 0 2 %if session"adminname"="" and Session"MEname"="" then% 0 3 style type="text/css" 0 4 style type="text/css" 0 5 !-- 0 6 body,td,th 0 7 font-size: 12px...

PT-2011-1643 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA 5500 series devices versions prior to 8.32 Description: The issue is related to an unspecified vulnerability in the SIP inspection feature, which allows remote attackers to cause a denial of service by...

DEBIAN-CVE-2010-4336

The currdcreatefile function src/utilsrrdcreate.c in collectd 4.x before 4.9.4 and before 4.10.2 allow remote attackers to cause a denial of service assertion failure via a packet with a timestamp whose value is 10 or less, as demonstrated by creating RRD files using the 1 RRDtool and 2 RRDCacheD...

New Local Linux Kernel Root Exploit Published

An interesting exploit for the Linux kernel that enables an attacker to escalate his privileges on a local machine has popped up on the Full Disclosure mailing list. The exploit chains together three separate bugs to get root on a vulnerable machine. The exploit was posted Tuesday by Dan Rosenber...

Linux Kernel 2.6.37 (RedHat Ubuntu 10.04) - Full-Nelson.c Local Privilege Escalation

Linux Kernel 2.6.37 RedHat Ubuntu 10.04 - Full-Nelson.c Local Privilege Escalation / Linux Kernel = 2.6.37 local privilege escalation by Dan Rosenberg @djrbliss on twitter Usage: gcc full-nelson.c -o full-nelson ./full-nelson This exploit leverages three vulnerabilities to get root, all of which...

php: information leak vulnerability in var_export()

The varexport function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if displayerrors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution...

Linux Kernel 2.6.37 - 'setup_arg_pages()' Denial of Service

// source: https://www.securityfocus.com/bid/44301/info / known for over a year, fixed in grsec bug is due to a bad limit on the max size of the stack for 32bit apps on a 64bit OS. Instead of them being limited to 1/4th of a 32bit address space, they're limited to 1/4th of a 64bit address space -...