Security update for dosbox (important)

openSUSE Security Update: Security update for dosbox Announcement ID: openSUSE-SU-2019:1920-1 Rating: important References: 1140254 Cross-References: CVE-2019-12594 CVE-2019-7165 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes two vulnerabilities is now available. Descriptio...

kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks

An issue was discovered in the procpidstack function in fs/proc/base.c in the Linux kernel. An attacker with a local account can trick the stack unwinder code to leak stack contents to userspace. The fix allows only root to inspect the kernel stack of an arbitrary task...

NewStart CGSL MAIN 4.05 : sudo Vulnerability (NS-SA-2019-0102)

The remote NewStart CGSL host, running version MAIN 4.05, has sudo packages installed that are affected by a vulnerability: - It was found that the original fix for CVE-2017-1000367 was incomplete. A flaw was found in the way sudo parsed tty information from the process status file in the proc...

NewStart CGSL MAIN 4.05 : sudo Vulnerability (NS-SA-2019-0097)

The remote NewStart CGSL host, running version MAIN 4.05, has sudo packages installed that are affected by a vulnerability: - A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo coul...

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

A flaw was found in the Linux kernel's implementation of IPMI remote baseband access. An attacker, with local access to read /proc/ioports, may be able to create a use-after-free condition when the kernel module is unloaded which may result in privilege escalation...

procps: Integer overflows leading to heap overflow in file2strvec

Multiple integer overflows leading to heap corruption flaws were discovered in file2strvec. These vulnerabilities can lead to privilege escalation for a local attacker who can create entries in procfs by starting processes, which will lead to crashes or arbitrary code execution in proc utilities...

Important: Red Hat Security Advisory: procps-ng security update

An update for procps-ng is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

A flaw was found in the Linux kernel's implementation of IPMI remote baseband access. An attacker, with local access to read /proc/ioports, may be able to create a use-after-free condition when the kernel module is unloaded which may result in privilege escalation...

PT-2019-3395

Name of the Vulnerable Software and Affected Versions Oracle Solaris affected versions not specified Description The issue is related to a flaw in the access control mechanism of the virtual file system /proc in Oracle Solaris, which could allow an attacker to execute arbitrary code...

Oracle Solaris vulnerable to arbitrary code execution via /proc/self

Overview Oracle Solaris 11 and Solaris 10 are vulnerable to arbitrary code execution if an attacker has read/write access to /proc/self in the process file system. Description The process file system /proc in Oracle Solaris 11 and Solaris 10 provides a self/ alias that refers to the current...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0035) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : - scsi: libfc: Fixup discmutex handling in fcoe module Hannes Reinecke Orabug: 29511036 - scsi: libfc: sanitize EDTOV and RATOV setting in fcp Hannes Reinecke Orabug: 29511036 - sysctl: Fix kabi breakag...

CVE-2019-8998

An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service the /proc filesystem of BlackBerry QNX Software Development Platform versions 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen proces...

CVE-2019-8998

CVE-2019-8998 affects BlackBerry QNX Software Development Platform up to version 6.5.0 SP1. The procfs (/proc) service exposes process information, enabling a less-privileged local attacker to access a target process address space (information disclosure leading to local privilege escalation). Se...

Updated dosbox package fixes security vulnerabilities

Dosbox 0.74-3 is a security release: Fixed that a very long line inside a bat file would overflow the parsing buffer. CVE-2019-7165 by Alexandre Bartel Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc e.g. /proc/self/mem when / or /proc we...

Karenderia CMS 5.1 Local File Inclusion

=========================================================================================== Exploit Title: Karenderia CMS 5.1 - LFI Vuln. Dork: N/A Date: 04-07-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: [email protected] Software Link:...

PT-2019-16087

Name of the Vulnerable Software and Affected Versions Android versions 7.0 through 9 Description The issue is related to a missing bounds check in the l2c lcc proc pdu function of l2c fcr.cc, which could lead to a possible out of bounds write. This could result in remote code execution over...

PT-2019-16123

Name of the Vulnerable Software and Affected Versions Android versions 7.0 through 9 Description The issue is related to a possible out-of-bound read in the llcp dlc proc rr rnr pdu function of llcp dlc.cc, due to a missing bounds check. This could lead to local information disclosure with no...

CentOS 6 : kernel (CESA-2019:1488) (SACK Panic) (SACK Slowness)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

USN-3968-2 sudo vulnerability

USN-3968-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Sudo did not properly parse the contents of /proc/pid/stat when attempting to determine its controlling tty. A local attacker in some...