MGASA-2015-0258 Updated php package fixes security vulnerability

Incorrect handling of paths with NULs CVE-2015-4598. OS command injection vulnerability in escapeshellarg CVE-2015-4642. Integer overflow in ftpgenlist resulting in heap overflow CVE-2015-4643. Segfault in phppgsqlmetadata CVE-2015-4644. PHP has been updated to version 5.5.26, which fixes multipl...

wesnoth: information leakage

Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function filesystem::getwmllocation to resolve file paths so that only...

Apple MAC OS X TOCTOU Competitive Conditions Vulnerability

Apple Mac OS X is a commercial operating system. A TOCTOU competition condition exists when Apple Mac OS X checksums kernel extension paths, allowing a local attacker to exploit a vulnerability to load unchecked kernel extensions...

[USN-2651-1] GNU patch vulnerabilities

========================================================================== Ubuntu Security Notice USN-2651-1 June 22, 2015 patch vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

php: missing null byte checks for paths in DOM and GD extensions

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

docker: Read/write proc paths allow host modification & information disclosure

Docker Engine before 1.6.1 uses weak permissions for 1 /proc/asound, 2 /proc/timerstats, 3 /proc/latencystats, and 4 /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image...

php: use after free in phar_object.c

A use-after-free flaw was found in PHP's phar PHP Archive paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory...

USN-2651-1: GNU patch vulnerabilities

Jakub Wilk discovered that GNU patch did not correctly handle file paths in patch files. An attacker could specially craft a patch file that could overwrite arbitrary files with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. CVE-2010-4651 László...

devel/ipython -- remote execution

Kyle Kelley reports: Summary: JSON error responses from the IPython notebook REST API contained URL parameters and were incorrectly reported as text/html instead of application/json. The error messages included some of these URL params, resulting in a cross site scripting attack. This affects use...

Elasticsearch vulnerability CVE-2015-4165

Summary: Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to...

php: use after free in phar_object.c

A use-after-free flaw was found in PHP's phar PHP Archive paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory...

php: buffer over-read in Phar metadata parsing

A buffer over-read flaw was found in PHP's phar PHP Archive paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory...

openSUSE Security Update : docker (openSUSE-2015-365)

docker was updated to version 1.6.1 to fix several security and non-security issues. - Updated to version 1.6.1 2015-05-07 bnc930235 - Security - Fix read/write /proc paths CVE-2015-3630 - Prohibit VOLUME /proc and VOLUME / CVE-2015-3631 - Fix opening of file-descriptor 1 CVE-2015-3627 - Fix...

McAfee ePO Deep Command Local Elevation of Privilege Vulnerability

McAfee ePO Deep Command is an extension of McAfee's primary endpoint security management product. A security vulnerability in Client Management and Gateway handling of windows search paths in McAfee ePO Deep Command allows local users to exploit the vulnerability to elevate privileges...

CVE-2015-3987

Multiple unquoted Windows search path vulnerabilities in the 1 Client Management and 2 Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors...

ownCloud Server Arbitrary File Upload Vulnerability

ownCloud is an open source private cloud server. The ownCloud Server has a security vulnerability that allows authenticated users to bypass the file blacklist list and upload arbitrary files, such as .htaccess files, via UTF-8 encoded file paths...

Critical: docker

Issue Overview: The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation. CVE-2015-3627...

Ubuntu 14.04 LTS : NetworkManager vulnerability (USN-2581-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2581-1 advisory. Tavis Ormandy discovered that NetworkManager incorrectly filtered paths when requested to read modem device contexts. A local attacker could possibly use this iss...

Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure

This module tests vulnerable IIS HTTP header file paths on Microsoft Exchange OWA 2003 and CAS 2007, 2010, and 2013 servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Outlook Web App OWA ...

Open-source ARJ archiver directory traversal vulnerability (CNVD-2015-02287)

Open-source ARJ archiver is an ARJ archive processing tool. Open-source ARJ archiver fails to properly remove slash notation from paths, allowing attackers to perform absolute path traversal attacks and write arbitrary files via specially crafted ARJ archives...