policycoreutils: SELinux sandbox escape via TIOCSTI ioctl

It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox...

policycoreutils: SELinux sandbox escape via TIOCSTI ioctl

It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox...

CVE-2016-5803

An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier. The Unified Infrastructure Management software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can...

CVE-2016-2779

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

AZL-6355 CVE-2016-2781 affecting package coreutils for versions less than 8.32-1

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

Buffer overflow

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

UBUNTU-CVE-2016-2781

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

CVE-2016-2781

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

CVE-2016-2779

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

CVE-2016-2781

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

UBUNTU-CVE-2016-10124

An issue was discovered in Linux Containers LXC before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container...

Unauthorized Access Vulnerability in Deephaven Jet Mixcall Customer Service System

Ltd. is a company that focuses on the research, development, manufacturing and sales of call centers and converged communication products. mixcall is one of the company's customer service systems. An unauthorized access vulnerability exists in the SZHJ Mixcall customer service system. Due to a la...

Lepton parent parameter SQL injection vulnerability

Lepton is a set of tools for lossless compression of JPEG format files. A SQL injection vulnerability exists in the Lepton parent parameter, which could allow an attacker to take control of the application, access or modify data, or exploit a potential vulnerability in the underlying database...

policycoreutils: SELinux sandbox escape via TIOCSTI ioctl

It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox...

The vulnerability of the Linux operating system, which allows a hacker to send signals to privileged processes

The vulnerability of the Linux operating system’s system call clone kernel function is related to deficiencies in access control. Exploiting this vulnerability allows an attacker, operating locally, to send signals to privileged parent processes from unprivileged child processes by creating a new...

Linux Kernel 2.6.22 3.9 - Dirty COW PTRACE_POKEDATA Race Condition (Write Access Method)

Linux Kernel 2.6.22 3.9 - Dirty COW PTRACEPOKEDATA Race Condition Write Access Method // $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball include //// pikachu include //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball include ////...

vhd-util tool to inspect the VHD headers of a VHD

vhd-util is a native utility of a XenServer used to inspect the VHD headers of a VHD. This will be useful to inspect the parent child relationship in VHD files...

The vulnerability of the SeaMonkey software allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this feature after release in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox allows malicious actors working remotely to execute arbitrary code or cause service failures errors in handling dynamic memory...

The vulnerability of Google Chrome’s browser allows a malicious actor to replace the user interface.

Google Chrome browser contains a vulnerability in the ScrollView::paint function located in platform/scroll/ScrollView.cpp. This vulnerability allows malicious actors to remotely replace the user interface by expanding the scroll bar on the parent frame...

SUSE-SU-2016:1602-1 Security update for ntp

ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations bsc982065. - CVE-2016-4954: Processing spoofed server packets bsc982066. - CVE-2016-4955: Autokey association reset bsc982067. -...