629 matches found
OpenJDK Insecure Temporary File Handling Vulnerability
OpenJDK is the Java Platform, Standard Edition and related projects of the open source implementation of the collaborative platform . OpenJDK suffers from an insecure hsperfdata temporary file handling issue, the exploitation of which could allow an attacker to conduct a symbolic link attack to...
Moderate: Red Hat Security Advisory: ppc64-diag security, bug fix and enhancement update
Updated ppc64-diag packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which giv...
didjvu and pdf2djvu Insecure Temporary File Creation Vulnerability
didjvu is a Python module, which uses a separate Kamera framework, foreground and background layers, and then into the DjVu file encoding. pdf2DjVu's main function is to djvu to pdf, is a command line djvu format, pdf format, inter-conversion tool. didjvu and pdf2djvu in the existence of security...
Zarafa Collaboration Platform Local Arbitrary File Write Vulnerability
Zarafa Collaboration Platform is a suite of open source email and calendaring software. A security vulnerability in the provider/server/ECServer.cpp file of Zarafa Collaboration Platform allows a local attacker to write arbitrary files by performing a symbolic link attack on the...
RedHat Update for kexec-tools RHSA-2015:0986-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
kexec security update
CentOS Errata and Security Advisory CESA-2015:0986 Updated kexec-tools packages that fix one security issue, one bug, and add one enhancement are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability...
kexec-tools: insecure use of /tmp/*$$* filenames
It was found that the module-setup.sh script provided by kexec-tools created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files...
[ MDVSA-2015:077 ] python-numpy
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:077 http://www.mandriva.com/en/support/security/ Package : python-numpy Date : March 27, 2015 Affected: Business Server 2.0 Problem Description: Updated python-numpy packages fix security vulnerabilities: f2...
Mandriva Linux Security Advisory : python-pillow (MDVSA-2015:099)
Updated python-imaging packages fix security vulnerabilities : Jakub Wilk discovered that temporary files were insecurely created via mktemp in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to...
Mandriva Linux Security Advisory : readline (MDVSA-2015:132)
Updated readline packages fix security vulnerability : Steve Kemp discovered the rltropen function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks CVE-2014-2524. Also, upstream patches have been added to fix an infinite loop in v...
Mandriva Linux Security Advisory : python-numpy (MDVSA-2015:077)
Updated python-numpy packages fix security vulnerabilities : f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859. %NASLMINLEVEL 70300 C Tenable...
Libbluray Symbolic Link Attack Local Security Bypass Vulnerability
libbluray is an open source library designed for Blu-ray Disc playback media players. A local security bypass vulnerability exists in the libbluray symbolic link attack, allowing an attacker to delete or corrupt sensitive files or launch a denial of service attack...
Moderate: Red Hat Security Advisory: ppc64-diag security, bug fix, and enhancement update
Updated ppc64-diag packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which giv...
Rsync Arbitrary File Write Vulnerability
rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. An arbitrary file write...
Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01260)
Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Phusion Passenger 4.0.37 suffers from a symbolic link attack vulnerability due to the program not creating temporary files in a secure manner. An...
Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01246)
Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Versions of Phusion Passenger prior to 4.0.37 have a symbolic link attack vulnerability due to the program not creating temporary files in a secure...
Shell-Redirection-Race-Condition
This could result in a symbolic link attack that could be used to corrupt any file that the owner of the redirecting shell has access to write to. This issue affects those systems running vulnerable versions of bash, tcsh, cash, ksh and sh. ksh is reportedly not vulnerable for IBM AIX systems...
GNU Coreutils Insecure Temporary File Creation Vulnerability
The GNU Coreutils are the basic file, shell and text manipulation tools used by the GNU operating system. An insecure temporary file creation vulnerability exists in GNU Coreutils that allows a local access attacker to potentially obtain sensitive information or perform a symbolic link attack to...
