Privilege escalation

A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to read any root file from the file system. An attacker would need local access to the machine to successful...

CVE-2018-4054

A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine to successfully...

CVE-2018-4054

A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine to successfully...

CVE-2019-5015

A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper helper tool. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine for a successful exploit...

CVE-2018-4055

Pixar Renderman for macOS contains a local privilege escalation in the install helper. The Mac version 22.2.0’s install helper Dispatch function does not verify the caller, allowing a local attacker to read any root file from the filesystem. Exploitation requires local access; impact is root-leve...

CVE-2018-4054

Pixar Renderman for macOS (22.2.0) contains a local privilege escalation in the install helper tool. The vulnerability lies in Dispatch where the caller is not checked, allowing a local user to execute code with root privileges via crafted argv data; the helper runs as root and listens after inst...

CVE-2019-5015

Pixar Renderman for macOS is affected by CVE-2019-5015 in the Install Helper, where the Dispatch function’s caller is not checked, allowing a local attacker with access to escalate to root. Affected version: Renderman 22.3.0 for macOS. The Talos advisory (TALOS-2019-0773) states exploitation requ...

CVE-2018-4055

A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to read any root file from the file system. An attacker would need local access to the machine to successful...

Cyber Security Week in Review (March 8)

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here. Top headlines this week Chinese tech company Huawei i...

Vulnerability Spotlight: Multiple local vulnerabilities in Pixar Renderman

Tyler Bohan of Cisco Talos discovered these vulnerabilities. Executive summary The MacOS version of Pixar Renderman contains three local vulnerabilities in its install helper tool. An attacker could exploit these bugs to escalate their privileges to root. Renderman is a rendering application used...

Pixar Renderman Install Helper Privilege Escalation Vulnerability

Summary A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0’s Install Helper helper tool. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine for a successful...

Pixar Renderman install helper privilege escalation vulnerability

Summary A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine to...

Pixar Renderman Install Helper Arbitrary File Read Privilege Escalation Vulnerability

Summary A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to read any root file from the file system. An attacker would need local access to the machine to...

Cross site scripting

Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into...

CVE-2018-5411

Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into...

CVE-2018-5411

Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into...

CVE-2018-5411

Pixar’s Tractor software, version 2.2 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the note field of a node. The attacker can inject JavaScript into the note, which is saved and later displayed to authenticated users, potentially enabling redirects, session cookie hi...

CVE-2018-5411 Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerability

Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into...

Pixar Tractor contains a stored cross-site scripting vulnerability

Overview Pixar's Tractor network rendering software is vulnerable to stored cross-site scripting which may allow an attacker to execute arbitrary JavaScript. Description Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability CWE-79 in the field tha...

Null pointer dereference

A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 0x69. The vulnerability is present in the parsing of a network packet without proper validation of the packet. The data read-in is not validated, and its use can lead to a null pointer dereference. The IT...