SquirrelMail -- post-authentication remote code execution

SquirrelMail developers report: SquirrelMail 1.4.22 and other versions before 201704270200-SVN allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote...

Command injection

sudonoexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the 1 system or 2 popen function...

UBUNTU-CVE-2016-7032

sudonoexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the 1 system or 2 popen function...

CVE-2016-7032

sudonoexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the 1 system or 2 popen function...

CVE-2017-7280

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable...

Remote code execution

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable...

CVE-2017-7280

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable...

NetGear lot of router remote command injection vulnerability analysis(Update Patch analysis)-vulnerability warning-the black bar safety net

0x01 introduction Two days before the NTP just doing the complete thing, the NetGear routerNETGEAR routerand to engage in things of T. T. The current CERT in the last week, five have issued a notice,“if the user comes to the router, it is recommended to stop use until the official release of the...

sudo: noexec bypass via system() and popen()

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system or popen C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use this flaw to execute...

Debian DLA-707-1 : sudo security update

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system, popen or wordexp C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw...

InfraPower PPS-02-S Q213V1 - Unauthenticated Remote Root Command Execution Vulnerability

Exploit for php platform in category web applications InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

CVE-2016-7032

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system or popen C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use this flaw to execute...

Updated graphicsmagick packages fix security vulnerability

- A read out-of-bound in the parsing of gif files using GraphicsMagick CVE-2015-8808. - Infinite loop caused by converting a circularly defined svg file CVE-2016-5240. - Fix another case of CVE-2016-2317 heap buffer overflow in the MVG rendering code also impacts SVG. - arithmetic exception...

openSUSE Security Update : ImageMagick (openSUSE-2016-757)

This update for ImageMagick fixes the following issues : This security issue was fixed : - CVE-2016-5118: Prevent code execution via popen bsc982178 This non-security issue was fixed : - Fix encoding of /Title in generated PDFs. bsc867943 This update was imported from the SUSE:SLE-12:Update updat...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2016:1570-1)

This update for ImageMagick fixes the following issues : This security issue was fixed : - CVE-2016-5118: Prevent code execution via popen bsc982178 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding...

SUSE: Security Advisory for ImageMagick (SUSE-SU-2016:1570-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Imagetragick patch to bypass the again command execution-vulnerability warning-the black bar safety net

Mood bloopers Hey Hey Hey,the old driver a word substandard will blast a hole Ah,this hole in the previous analysisCVE-2 0 1 6-3 7 1 4when found,the result being to cover their rotten...heart SeseI'll write about at the time is how to find out how this hole... Vulnerability analysis of the text...

[slackware-security] imagemagick

New imagemagick packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/imagemagick-6.8.610-i486-3slack14.1.txz: Rebuilt. Removed popen support to prevent another shell vulnerability. This issu...

GraphicsMagick and ImageMagick Code Execution Vulnerabilities

GraphicsMagick is a set of simple image processing tools, the tool to the image to provide resizing, rotation, highlighting and other functions.ImageMagick is the U.S. ImageMagick Studio, Inc. of a set of open-source image processing software, the software can read, convert, write a variety of...

ISUCON5 qualifier OS Command Injection Vulnerability

ISUCON5 qualifier is a suite of qualifier portal applications. ISUCON5 qualifier's eventapp/lib/gcloud.rb fails to make the correct popen call, allowing remote attackers to submit HTTP requests containing special metacharacters to execute arbitrary commands...