Kernel: vfs: Do not allow escaping from bind mounts

A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their...

Kernel: vfs: Do not allow escaping from bind mounts

A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their...

DEBIAN-CVE-2015-2925

The prependpath function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."...

CVE-2015-2925

The prependpath function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."...

CVE-2015-2925

The prependpath function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."...

Ubuntu: Security Advisory (USN-2794-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2795-1)

It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. CVE-2015-2925 Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver...

USN-2799-1: Linux kernel vulnerabilities

It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. CVE-2015-2925 Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver...

USN-2794-1: Linux kernel vulnerabilities

It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. CVE-2015-2925 Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver...

kernel: fs: deadlock due to incorrect usage of rename_lock

A flaw was found in the way the Linux kernel's VFS subsystem handled file system locks. A local, unprivileged user could use this flaw to trigger a deadlock in the kernel, causing a denial of service on the system...

kernel: fs: deadlock due to incorrect usage of rename_lock

A flaw was found in the way the Linux kernel's VFS subsystem handled file system locks. A local, unprivileged user could use this flaw to trigger a deadlock in the kernel, causing a denial of service on the system...

kernel: fs: deadlock due to incorrect usage of rename_lock

A flaw was found in the way the Linux kernel's VFS subsystem handled file system locks. A local, unprivileged user could use this flaw to trigger a deadlock in the kernel, causing a denial of service on the system...

Bolt Arbitrary Code Execution Vulnerability

Bolt is a set of open source content management tools. Bolt theme editor rename files failed to check the file extension , allowing remote attackers can rename specially crafted files to execute arbitrary code...

PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow

No description provided by source. !/usr/bin/python import socket import sys msfvenom -p windows/shellbindtcp lhost=192.168.1.130 lport=4444 -b '\x00\x0a\x0b\x27\x36\xce\xc1\x04\x14\x3a\x44\xe0\x42\xa9\x0d' -f ruby Payload size: 352 bytes shellcode =...

PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: PCMan's FTP Server v2.0 - RENAME command remote buffer overflow Date: 29 Aug 2015 Exploit Author: Koby Vendor Homepage: http://pcman.openfoundry.org/ Version: 2.0.7 Tested on: Windows XP SP3 import socket...

PCMan FTP Server 2.0.7 - RENAME Remote Buffer Overflow

PCMan FTP Server 2.0.7 - RENAME Remote Buffer Overflow !/usr/bin/python Exploit Title: PCMan's FTP Server v2.0 - RENAME command remote buffer overflow Date: 29 Aug 2015 Exploit Author: Koby Vendor Homepage: http://pcman.openfoundry.org/ Software Link:...

Visual Mining NetCharts Server projectContents.jsp File Rename Denial of Service (CVE-2015-4032)

A denial of service condition vulnerability has been reported in Visual Mining NetCharts Server projectContents.jsp page. The vulnerability is due to arbitrary directory traversal when renaming a file. A remote attacker can exploit this vulnerability to create a denial of service condition...

WordPress wp-instance-rename 'mysqldump_download.php' plugin arbitrary file download vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The WordPress wp-instance-rename 'mysqldumpdownload.php' plugin has an arbitrary file download vulnerability due to the program failing to adequately filter...

UBUNTU-CVE-2015-3727

WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site...

wp-instance-rename <= 1.0 - Arbitrary File Download

The wp-instance-rename WordPress plugin was affected by an Arbitrary File Download security vulnerability. url --data "dbname=wp&dumpfname=/etc/passwd&backupfolder=." http://www.example.com/wp-instance-rename/mysqldumpdownload.php -o p.zip...