Debian: Security Advisory (DSA-4552-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4166-2 php5 vulnerability

USN-4166-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations. A remote attacker could possibly use...

Debian DSA-4553-1 : php7.3 - security update

Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

SUSE-SU-2019:2686-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Updated to version 6.2.7.1. Security issues fixed: - CVE-2019-9854: Fixed unsafe URL assembly flaw bsc1149944. - CVE-2019-9855: Fixed path equivalence handling flaw bsc1149943...

NETGEAR AC1200 mini_httpd Poison Null Byte Authentication Bypass Vulnerability

The NETGEAR AC1200 is a wireless router from NETGEAR. A security vulnerability exists in the path string handling process in the NETGEAR AC1200. An attacker could exploit the vulnerability to bypass authentication on the system...

CVE-2017-1000115

A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository...

systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash

It was discovered that systemd allocates a buffer large enough to store the path field of a dbus message without performing enough checks. A local attacker may trigger this flaw by sending a dbus message to systemd with a large path making systemd crash or possibly elevating his privileges...

SUSE-SU-2019:2402-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Updated to version 6.2.7.1. Security issues fixed: - CVE-2019-9849: Disabled fetching remote bullet graphics in 'stealth mode' bsc1141861. - CVE-2019-9848: Fixed an arbitrary script execution via LibreLogo bsc1141862. - CVE-2019-9851: Fixed...

CVE-2019-1268

An elevation of privilege exists when Winlogon does not properly handle file path information, aka 'Winlogon Elevation of Privilege Vulnerability'...

Winlogon Elevation of Privilege Vulnerability

An elevation of privilege exists when Winlogon does not properly handle file path information. An attacker who successfully exploited this vulnerability could run arbitrary code. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. T...

CVE-2019-9855

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...

ruby: Unintentional directory traversal by poisoned NULL byte in Dir

It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script...

mozilla: Use after free in Skia

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Privilege escalation

VMware Workstation 15.x before 15.0.3, 14.x before 14.1.6 running on Windows does not handle paths appropriately. Successful exploitation of this issue may allow the path to the VMX executable, on a Windows host, to be hijacked by a non-administrator leading to elevation of privilege...

The vulnerability of VMware Workstation’s virtualization platform lies in its security flaws related to the handling of executable file paths, allowing attackers to escalate their privileges.

The vulnerability of VMware Workstation’s virtualization platform is related to deficiencies in security mechanisms for processing pathnames of executable files. Exploiting this vulnerability can allow attackers to gain increased privileges...

mozilla: Use after free in Skia

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the unacev2.dll library of the WinRAR file compressor allows a hacker to place malicious files anywhere on the disk.

The vulnerability of the unacev2.dll file archiver in WinRAR is related to errors in processing the file name field the relative path is converted to an absolute path. Exploiting this vulnerability allows a remote attacker to place malicious files in any desired location on the disk using a...

mozilla: Use after free in Skia

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2018-18356

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

DEBIAN-CVE-2018-18356

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...