cyrus-sasl -- dynamic library loading and set-user-ID applications

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...

ifmail -- unsafe set-user-ID application

Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the news' user...

bmon -- unsafe set-user-ID application

Jon Nistor reported that the FreeBSD port of bmon was installed set-user-ID root, and executes commands using relative paths. This could allow local user to easily obtain root privileges...

DEBIAN-CVE-2003-0396

Buffer overflow in les for ATM on Linux linux-atm before 2.4.1, if used setuid, allows local users to gain privileges via a long -f command line argument...

ChiTeX/ChiLaTeX unsafe set-user-id root

Niels Heinen reports that ChiTeX installs set-user-id root executables that invoked system3 without setting up the environment, trivially allowing local root compromise...

DEBIAN-CVE-2002-0740

Buffer overflow in slrnpull for the SLRN package, when installed setuid or setgid, allows local users to gain privileges via a long -d SPOOLDIR argument...

Переполнения буфера в утилитах Caldera Open Unix (buffer overflow)

Переполнения буфера во многих suid-утилитах...

CVE-2026-53614

Local Privilege Escalation via LIBMOUNTFORCEMOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount8...

PT-2010-5671 · Linux +1 · Linux-Pam +1

Name of the Vulnerable Software and Affected Versions: Linux-PAM versions prior to 1.1.2 Description: The issue is related to the run coprocess function in pam xauth.c in the pam xauth module, which does not check the return values of the setuid, setgid, and setgroups system calls. This might all...