Recommended update for adcli, sssd (moderate)

openSUSE Security Update: Recommended update for adcli, sssd Announcement ID: openSUSE-SU-2019:1174-1 Rating: moderate References: 1109849 1110121 1121759 1125617 1127670 Cross-References: CVE-2019-3811 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has four fix...

GLSA-201904-05 : BURP: Root privilege escalation

The remote host is affected by the vulnerability described in GLSA-201904-05 BURP: Root privilege escalation It was discovered that Gentoos BURP ebuild does not properly set permissions or place the pid file in a safe directory. Additionally, the first set of patches did not completely address...

SUSE SLED12 / SLES12 Security Update : Recommended update for adcli, sssd (SUSE-SU-2019:0805-1)

This update for adcli and sssd provides the following improvement : Security vulnerability fixed : CVE-2019-3811: Fix fallbackhomedir returning '/' for empty home directories bsc1121759 Other fixes: Add an option to disable checking for trusted domains in the subdomains provider bsc1125617 Clear...

SUSE-SU-2019:0805-1 Recommended update for adcli, sssd

This update for adcli and sssd provides the following improvement: Security vulnerability fixed: - CVE-2019-3811: Fix fallbackhomedir returning '/' for empty home directories bsc1121759 Other fixes: - Add an option to disable checking for trusted domains in the subdomains provider bsc1125617 -...

Denial Of Service

tuned is vulnerable to denial of service DoS. The vulnerability can happen because of creation of PID file with insecure permissions, allowing local users to kill arbitrary processes...

mysql: pid file can be created in a world-writeable directory (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where...

GLSA-201810-08 : PostgreSQL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201810-08 PostgreSQL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in PostgreSQL. Please review the referenced CVE identifiers for details. In addition it was discovered that Gentoos PostgreSQL installati...

Pyro Arbitrary File Overwrite Vulnerability

pyro is a distributed object technology system written in the Python language. An arbitrary file overwrite vulnerability exists in pyro versions prior to 3.15, which stems from a program that does not securely handle pid files in a temporary directory and opens the pid file as root. The...

CVE-2011-2765

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks...

CVE-2011-2765

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks...

PYSEC-2018-99

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks...

CVE-2017-18226

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

GLSA-201806-03 : BURP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201806-03 BURP: Multiple vulnerabilities It was discovered that Gentoos BURP ebuild does not properly set permissions or place the pid file in a safe directory. Impact : A local attacker could escalate privileges. Workaround : Use...

Gentoo app-backup/burp package design vulnerability

The Gentoo app-backup/burp package is a network backup and recovery program from the Gentoo Foundation. A security vulnerability in the Gentoo app-backup/burp package prior to version 2.1.32 stems from the program setting ownership of the PID file directory to the burp account. A local attacker...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

Arbitrary file deletion

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18284

The CVE-2017-18284 entry concerns Gentoo app-backup/burp prior to version 2.1.32, where the PID file directory is owned by the burp user. This may allow a local attacker with access to the burp account to modify the PID file and terminate arbitrary processes before a root script issues a SIGKILL....

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...