Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01246)

Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Versions of Phusion Passenger prior to 4.0.37 have a symbolic link attack vulnerability due to the program not creating temporary files in a secure...

Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01260)

Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Phusion Passenger 4.0.37 suffers from a symbolic link attack vulnerability due to the program not creating temporary files in a secure manner. An...

Rsync Arbitrary File Write Vulnerability

rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. An arbitrary file write...

Shell-Redirection-Race-Condition

This could result in a symbolic link attack that could be used to corrupt any file that the owner of the redirecting shell has access to write to. This issue affects those systems running vulnerable versions of bash, tcsh, cash, ksh and sh. ksh is reportedly not vulnerable for IBM AIX systems...

GNU Coreutils Insecure Temporary File Creation Vulnerability

The GNU Coreutils are the basic file, shell and text manipulation tools used by the GNU operating system. An insecure temporary file creation vulnerability exists in GNU Coreutils that allows a local access attacker to potentially obtain sensitive information or perform a symbolic link attack to...

CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

DEBIAN-CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

UBUNTU-CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a 1 symlink or 2 hard link attack in an image archive in a a pull or b load operation...

CVE-2014-6407

CVE-2014-6407 affects Docker up to 1.3.2, where attackers could write arbitrary files and execute code via a symlink or hard link attack in an image archive during pull or load. Evidence from connected docs shows fixed in the openSUSE/SUSE docker 1.3.2 update (docker-docker-stable forks) addressi...

PT-2014-7210 · Docker +1 · Docker +1

Name of the Vulnerable Software and Affected Versions: Docker versions prior to 1.3.2 Description: The issue allows remote attackers to write to arbitrary files and execute arbitrary code via a symlink or hard link attack in an image archive during a pull or load operation. This can be achieved...

Amazon Linux AMI : perltidy (ALAS-2014-356)

It was discovered that perltidy's maketemporaryfilename function insecurely created temporary files via the use of the tmpnam function. A local attacker could use this flaw to perform a symbolic link attack. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

RHEL 7 : java-1.7.0-openjdk (RHSA-2014:0675)

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

RHEL 7 : java-1.6.0-openjdk (RHSA-2014:0685)

Updated java-1.6.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Sun Cobalt RaQ 4.0 Predictable Temporary Filename Symbolic Link Attack Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5529/info A vulnerability has been reported in Cobalt RaQ that may allow attackers to obtain elevated privileges. The vulnerability exists in the /usr/lib/authenticate utility which is used by Apache for authentication...

Musicqueue 1.2 SIGSEGV Signal Handler Insecure File Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8899/info A vulnerability has been reported for Musicqueue. The problem specifically occurs within a signal handling procedure used invoked when a segmentation violation occurs. The procedure invokes a library function,...

Sun Connection Update Manager for Solaris Multiple Insecure Temporary File Creation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/38928/info Sun Connection Update Manager for Solaris creates temporary files in an insecure manner. An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting...

RHEL 5 / 6 : JBoss Web Server (RHSA-2013:0871)

Updated tomcat6 and tomcat7 packages that fix one security issue are now available for JBoss Enterprise Web Server 2.0.0 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

Low: perl-Capture-Tiny

Issue Overview: It was found 1 that the Capture::Tiny module, provided by the perl-Capture-Tiny package, used the File::temp::tmpnam module to generate temporary files: ./lib/Capture/Tiny.pm: $stash-flagfiles$which = scalar tmpnam; This module makes use of the mktemp function when called in the...

Important: Red Hat Security Advisory: java-1.6.0-openjdk security update

Updated java-1.6.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...