perl -- vulnerabilities in PERLIO_DEBUG handling

Kevin Finisterre discovered bugs in perl's I/O debug support: The environmental variable PERLIODEBUG is honored even by the set-user-ID perl command usually named sperl or suidperl. As a result, a local attacker may be able to gain elevated privileges. CVE-2005-0155 A buffer overflow may occur in...

CVE-2005-0295

npptnt2.sys in nProtect Gameguard provides unrestricted I/O to any process that calls it, which allows local users to gain privileges...

Faq-O-Matic fom.cgi Multiple Parameter XSS

The remote host runs Faq-O-Matic, a CGI-based system that automates the process of maintaining a FAQ. The remote version of this software is vulnerable to cross-site scripting attacks in the script 'fom.cgi'. With a specially crafted URL, an attacker can cause arbitrary code execution resulting i...

Debian DSA-109-1 : faqomatic - XSS vulnerability

Due to unescaped HTML code Faq-O-Matic returned unverified scripting code to the browser. With some tweaking this enables an attacker to steal cookies from one of the Faq-O-Matic moderators or the admin. Cross-Site Scripting is a type of problem that allows a malicious person to make another pers...

Debian DSA-312-1 : kernel-patch-2.4.18-powerpc - several vulnerabilities

A number of vulnerabilities have been discovered in the Linux kernel. CVE-2002-0429: The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a binary compatibility interface lcall. CAN-2003-0001: Multiple...

AIX 5.2 : IY46784

The remote host is missing AIX Critical Security Patch number IY46784 Possible data error using memory mapped I/O in cachefs. You should install this patch for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...

RHEL 2.1 : fileutils (RHSA-2003:310)

Updated fileutils packages that close a potential denial of service vulnerability are now available. The fileutils package contains several basic system utilities. One of these utilities is the 'ls' program, which is used to list information about files and directories. Georgi Guninski discovered...

Linux kernel in/out ports access

Mask for input/output permissions is not cleared for child process. It may lead to unauthorized access to i/o ports...

DSA-332 linux-kernel-2.4.17 - several vulnerabilities

Bulletin has no description...

CVE-2003-0246

The ioperm system call in Linux kernel 2.4.20 and earlier does not properly restrict privileges, which allows local users to gain read or write access to certain I/O ports...

(RHSA-2003:147) kernel security update

The Linux kernel handles the basic functions of the operating system. Two potential data corruption scenarios have been identified. These scenarios can occur under heavy, complex I/O loads. The first scenario only occurs while performing memory mapped file I/O, where the file is simultaneously...

CVE-2003-0246

The ioperm system call in Linux kernel 2.4.20 and earlier does not properly restrict privileges, which allows local users to gain read or write access to certain I/O ports...

CVE-2002-2011

Cross-site scripting XSS vulnerability in the fom CGI program fom.cgi in Faq-O-Matic 2.711 and 2.712 allows remote attackers to inject arbitrary web script or HTML via the file parameter...

DEBIAN-CVE-2002-1896

Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long 1 -f or 2 -o command line argument...

CVE-2002-0572

CVE-2002-0572 affects BSD-based systems (notably FreeBSD 4.5 and earlier); the issue arises when a local user closes standard input/output/error (FDs 0–2) and a subsequent setuid-invoked I/O operation reuses those descriptors, allowing read/write access to restricted files. Connected records corr...

CVE-2002-0230

Cross-site scripting vulnerability in fom.cgi of Faq-O-Matic 2.712 allows remote attackers to execute arbitrary Javascript on other clients via the cmd parameter, which causes the script to be inserted into an error message...

CVE-2002-0230

CVE-2002-0230 covers a cross-site scripting (XSS) flaw in Faq-O-Matic’s fom.cgi (v2.712) that allows an attacker to inject arbitrary Javascript on other clients via the cmd parameter. Multiple connected sources corroborate an XSS issue in Faq-O-Matic, with OpenVAS and Tenable plugins referencing ...

CVE-2002-0230

Cross-site scripting vulnerability in fom.cgi of Faq-O-Matic 2.712 allows remote attackers to execute arbitrary Javascript on other clients via the cmd parameter, which causes the script to be inserted into an error message...

CVE-1999-1214

The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID...

CVE-1999-1214

The CVE-1999-1214 issue affects the 4.4 BSD kernel’s asynchronous I/O facility. It does not validate credentials when setting the recipient of I/O notification, allowing a local user to trigger a signal to an arbitrary process ID via specific ioctl/fcntl calls, causing a denial of service. The do...