libguestfs: virt-edit creates a new file, when it is used leading to loss of file attributes (permissions, owner, SELinux context etc.)

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

Low: Red Hat Security Advisory: libguestfs security, bug fix, and enhancement update

Updated libguestfs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, whic...

python: distutils creates ~/.pypirc insecurely

Python 2.6 through 3.2 creates /.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file...

python: distutils creates ~/.pypirc insecurely

Python 2.6 through 3.2 creates /.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file...

AirOs (NanoStation,AirGrid) M5 Multiple Vulnerabilities

Exploit for hardware platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1...

[SECURITY] Fedora 17 Update: perl-Config-IniFiles-2.72-1.fc17

Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...

Mod_Auth_OpenID Session Stealing

https://github.com/paranoid/modauthopenid/blob/master/CVE-2012-2760.markdown Security Advisory 1201 Summary : Session stealing Date : May 2012 Affected versions : all versions prior to modauthopenid-0.7 ID : modauthopenid-1201 CVE reference : CVE-2012-2760 Details Session ids are stored insecurel...

[SECURITY] Fedora 16 Update: perl-Config-IniFiles-2.72-1.fc16

Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...

[SECURITY] Fedora 15 Update: perl-Config-IniFiles-2.72-1.fc15

Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...

Fedora Update for perl-Config-IniFiles FEDORA-2012-7802

Check for the Version of perl-Config-IniFiles OpenVAS Vulnerability Test Fedora Update for perl-Config-IniFiles FEDORA-2012-7802 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Fedora Update for perl-Config-IniFiles FEDORA-2012-7777

Check for the Version of perl-Config-IniFiles OpenVAS Vulnerability Test Fedora Update for perl-Config-IniFiles FEDORA-2012-7777 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Microsoft Adopts CVRF Format for Security Bulletins

Since the beginning of recorded time, security researchers, software vendors and hackers have been issuing security advisories in all kinds of nutty formats. Some feature excellent ASCII art, some have clever inside jokes and some come from Microsoft. Now, there’s a effort underway, called the...

CVE-2012-0863

Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file...

CVE-2012-0863

Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file...

CVE-2012-0863

Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file...

CVE-2012-0863

Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file...

CVE-2012-0863

CVE-2012-0863 affects Mumble up through version 1.2.3 where the client stores its data in the file ~/.local/share/data/Mumble/.mumble.sqlite with world-readable permissions. This allows a local attacker to read the database and obtain cleartext passwords and configuration data. Multiple distribut...

Android information leak

---------------------------- Vulnerability Description ---------------------------- We found that any android application can read all world-readable files in the "/proc" directory without specifying any permissions in their manifest files. This can leak sensitive information. For example, if the...

Oracle Exadata Infiniband Switch default logins and world readable shadow file

Oracle Exadata Infiniband Switch default logins and world readable shadow file Hi Bugtraq List, I've noticed a minor issue with the 1/4 rack Oracle Exadata Solution. What is Exadata? From Oracle.com "Oracle Exadata is the only database machine that provides extreme performance for both data...

Fedora 15 : uzbl-0-0.26.20110402gite7578e27c.fc15 (2012-2364)

Lock down cookie file permissions to not be world-readable. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...