Linux Kernel 2.4/2.6 sock_sendpage() Local Root Exploit (ppc)

No description provided by source. / Linux socksendpage NULL pointer dereference Copyright 2009 Ramon de Carvalho Valle [email protected] This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwar...

Linux Kernel 2.6 < 2.6.19 (32bit) ip_append_data() ring0 Root Exploit

No description provided by source. / 0x82-CVE-2009-2698 Linux kernel 2.6 2.6.19 32bit ipappenddata local ring0 root exploit Tested White Box 42.6.9-5.ELsmp, CentOS 4.42.6.9-42.ELsmp, CentOS 4.52.6.9-55.ELsmp, Fedora Core 42.6.11-1.1369FC4smp, Fedora Core 52.6.15-1.2054FC5, Fedora Core...

CentOS 3 : kernel (CESA-2009:1233)

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. These...

RHEL 4 : kernel (RHSA-2009:1223)

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. These...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. These...

Linux Kernel 2.42.6 (RedHat Linux 9 Fedora Core 4 11 Whitebox 4 CentOS 4) - sock_sendpage() Ring0 Privilege Escalation (5)

Linux Kernel 2.42.6 RedHat Linux 9 Fedora Core 4 11 Whitebox 4 CentOS 4 - socksendpage Ring0 Privilege Escalation 5 / 0x82-CVE-2009-2692 Linux kernel 2.4/2.6 32bit socksendpage local ring0 root exploit simple ver Tested RedHat Linux 9.0, Fedora core 411, Whitebox 4, CentOS 4.x. -- Discovered by...

kernel

New Linux kernel packages are available for Slackware 12.2 and -current to address a security issue. A kernel bug discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team could allow a local user to fill memory page zero with arbitrary code and then use the kernel sendpage...

Debian: Security Advisory (DSA-1838-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PulseAudio (setuid) Priv. Escalation Exploit (ubu/9.04)(slack/12.2.0)

No description provided by source. PulseAudio setuid Local Privilege Escalation Vulnerability http://www.securityfocus.com/bid/35721 Credit for discovery of bug: Tavis Ormandy, Julien Tinnes and Yorick Koster -- Put files in /tmp/pulseaudio-exp or change config.h. Must be on same fs as the...

PulseAudio (setuid) Priv. Escalation Exploit (ubu/9.04)(slack/12.2.0)

Exploit for linux platform in category local exploits ===================================================================== PulseAudio setuid Priv. Escalation Exploit ubu/9.04slack/12.2.0 ===================================================================== PulseAudio setuid Local Privilege...

Ubuntu 8.04 LTS / 8.10 / 9.04 : pulseaudio vulnerability (USN-804-1)

Tavis Ormandy, Julien Tinnes, and Yorick Koster discovered that PulseAudio did not safely re-execute itself. A local attacker could exploit this to gain root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

GLSA-200905-05 : FreeType: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200905-05 FreeType: Multiple vulnerabilities Tavis Ormandy reported multiple integer overflows in the cffcharsetcomputecids function in cff/cffload.c, sfnt/tccmap.c and the ftsmoothrendergeneric function in smooth/ftsmooth.c,...

FreeType: Multiple vulnerabilities

Background FreeType is a high-quality and portable font engine. Description Tavis Ormandy reported multiple integer overflows in the cffcharsetcomputecids function in cff/cffload.c, sfnt/tccmap.c and the ftsmoothrendergeneric function in smooth/ftsmooth.c, possibly leading to heap or stack-based...

DSA-1796-1 libwmf - denial of service

Bulletin has no description...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : libwmf vulnerability (USN-769-1)

Tavis Ormandy discovered that libwmf incorrectly used memory after it had been freed when using its embedded GD library. If a user or automated system were tricked into opening a crafted WMF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user...

RedHat Security Advisory RHSA-2009:0457

The remote host is missing updates announced in advisory RHSA-2009:0457. libwmf is a library for reading and converting Windows Metafile Format WMF vector graphics. libwmf is used by applications such as GIMP and ImageMagick. A pointer use-after-free flaw was found in the GD graphics library...

openSUSE 10 Security Update : freetype2 (freetype2-6185)

Freetype was updated to fix some integer overflows that can be exploited remotely in conjunction with programs like a web-browser. CVE-2009-0946 Thanks to Tavis Ormandy who found the bugs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

RedHat Security Advisory RHSA-2009:0457

The remote host is missing updates announced in advisory RHSA-2009:0457. libwmf is a library for reading and converting Windows Metafile Format WMF vector graphics. libwmf is used by applications such as GIMP and ImageMagick. A pointer use-after-free flaw was found in the GD graphics library...

USN-769-1: libwmf vulnerability

Tavis Ormandy discovered that libwmf incorrectly used memory after it had been freed when using its embedded GD library. If a user or automated system were tricked into opening a crafted WMF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user...

RHEL 4 / 5 : libwmf (RHSA-2009:0457)

Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libwmf is a library for reading and converting Windows Metafile Format WMF vector...