SUSE-SU-2017:0874-1 Security update for Linux Kernel Live Patch 4 for SLE 12 SP1

This update for the Linux Kernel 3.12.57-6035 fixes one issue. The following security bugs were fixed: - CVE-2017-7184: The XFRM processsing in the Linux kernel 16.10 allowed local users to obtain root privileges or cause a denial of service heap-based out-of-bounds access via an integer overflow...

Linux Kernel 4.4.0 Ubuntu DCCP Double-Free Privilege Escalation

// A proof-of-concept local root exploit for CVE-2017-6074. // Includes a semireliable SMAP/SMEP bypass. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074 // // Usage: // $ gcc poc.c -o pwn // $ ./pwn // . namespace sandbox setup...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free Privilege Escalation

Linux Kernel 4.4.0 Ubuntu - DCCP Double-Free Privilege Escalation // // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A proof-of-concept local root exploit for CVE-2017-6074. // Includes a semireliable SMAP/SMEP bypass. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. //...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free Privilege Escalation

// // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A proof-of-concept local root exploit for CVE-2017-6074. // Includes a semireliable SMAP/SMEP bypass. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-607...

UBUNTU-CVE-2017-0358

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation...

Kaspersky 17.0.0 - Local CA Root Incorrectly Protected

Kaspersky 17.0.0 - Local CA Root Incorrectly Protected / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=989 When Kaspersky generate a private key for the local root, they store the private key in %ProgramData%. Obviously this file cannot be shared, because it's the private key...

IBM AIX 6.1/7.1/7.2 - Bellmail Privilege Escalation Vulnerability

Exploit for aix platform in category local exploits !/usr/bin/sh CVE-2016-8972/bellmailroot.sh: IBM AIX Bellmail local root Affected versions: AIX 6.1, 7.1, 7.2 VIOS 2.2.x Fileset Lower Level Upper Level KEY --------------------------------------------------------- bos.net.tcp.client 6.1.9.0...

Cisco Hybrid Media Service Elevation of Privilege Vulnerability

Cisco Hybrid Media Service is a hybrid media service developed by Cisco. An elevation of privilege vulnerability exists in the Cisco Hybrid Media Service installer, which allows local attackers to exploit the vulnerability to gain local ROOT privileges...

CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

UBUNTU-CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

AIX 5.3 / 6.1 / 7.1 / 7.2 lquerylv Local Root

!/usr/bin/sh AIX lquerylv 5.3, 6.1, 7.1, 7.2 local root exploit. Tested against latest patchset 7100-04 This exploit takes advantage of known issues with debugging functions within the AIX linker library. We are taking advantage of known functionality, and focusing on badly coded SUID binaries...

AIX 6.1 / 7.1 / 7.2.0.2 lsmcode Local Root

!/usr/bin/sh AIX lsmcode local root exploit. Affected: AIX 6.1/7.1/7.2.0.2 Blog post URL: https://rhinosecuritylabs.com/2016/11/03/unix-nostalgia-hunting-zeroday-vulnerabilities-ibm-aix/ lqueryroot.sh by @hxmonsegur 2016 //RSL ROOTSHELL=/tmp/shell-$od -N4 -tu /dev/random | awk 'NR==1 print $2 ' i...

Apache Tomcat on Debian-Based Distros - Privilege Escalation Vulnerability

Exploit for linux platform in category local exploits ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-1240 - Release date: 30.09.2016 - Revision: 1 - Severity: High...

CVE-2016-6276

Citrix Linux Virtual Delivery Agent aka VDA, formerly Linux Virtual Desktop before 1.4.0 allows local users to gain root privileges via unspecified vectors...

CVE-2016-4710

WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4709...

CVE-2016-4710: Incorrect Type Conversion or Cast

WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4709...

CVE-2016-6413: Undefined Security Weakness

The installation procedure on Cisco Application Policy Infrastructure Controller APIC devices 1.32f mishandles binary files, which allows local users to obtain root access via unspecified vectors, aka Bug ID CSCva50496...

EMC Avamar Data Store and Avamar Virtual Edition Command Injection Vulnerability

EMC Avamar is a backup and recovery solution from EMC Corporation. The solution provides data backup, disaster recovery, deduplication, etc. Avamar Data Store ADS is one of the components used for data backup; Avamar Virtual Edition AVE is one of the components used to realize the replication...

Juniper Junos SRX Series Upgrade Handling Local Root Authentication Bypass (JSA10753)

According to its self-reported version number, the remote Juniper Junos device is affected by a security bypass vulnerability due to a flaw that is triggered when using the partition option during an upgrade. A local attacker can exploit this to bypass authentication checks and access the root...