3887 matches found
FreeBSD : cups-lpr -- lppasswd multiple vulnerabilities (7850a238-680a-11d9-a9e7-0001020eed82)
D. J. Bernstein reports that Bartlomiej Sieka has discovered several security vulnerabilities in lppasswd, which is part of CUPS. In the following excerpt from Bernstein's email, CVE names have been added for each issue : First, lppasswd blithely ignores write errors in fputsline,outfile at lines...
FreeBSD : mpg123 -- buffer overflow in URL handling (20d16518-2477-11d9-814e-0001020eed82)
Carlos Barros reports that mpg123 contains two buffer overflows. These vulnerabilities can potentially lead to execution of arbitrary code. The first buffer overflow can occur when mpg123 parses a URL with a user-name/password field that is more than 256 characters long. This problem can be...
CVE-2005-2180: Undefined Security Weakness
gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access, which allows local users to overwrite arbitrary files...
GNU GNATS 4.0/4.1 - Gen-Index Arbitrary Local File Disclosure/Overwrite
source: https://www.securityfocus.com/bid/14169/info GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files. A successful attack can result in privilege escalation and a complete compromise of the affected computer as gen-index is installed with setuid permissions. G...
GNU GNATS 4.04.1 - Gen-Index Arbitrary Local File DisclosureOverwrite
GNU GNATS 4.04.1 - Gen-Index Arbitrary Local File DisclosureOverwrite source: https://www.securityfocus.com/bid/14169/info GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files. A successful attack can result in privilege escalation and a complete compromise of the...
CVE-2005-2072
CVE-2005-2072 affects the runtime linker (ld.so) in Solaris 8, 9, and 10, where LD_AUDIT in setuid/setgid contexts can be abused to gain privileges (including by using a long LD_AUDIT value). Connected advisories list vendor patches addressing this: Solaris 8/9/10 patches 109147-44, 109148-42, 11...
CVE-2005-2072
The runtime linker ld.so in Solaris 8, 9, and 10 trusts the LDAUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by 1 modifying LDAUDIT to reference malicious code and possibly 2 using a long value for LDAUDIT...
CVE-2005-2072: Undefined Security Weakness
The runtime linker ld.so in Solaris 8, 9, and 10 trusts the LDAUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by 1 modifying LDAUDIT to reference malicious code and possibly 2 using a long value for LDAUDIT...
CVE-2002-1963
Linux kernel 2.4.1 through 2.4.19 sets root's NRRESERVEDFILES limit to 10 files, which allows local users to cause a denial of service resource exhaustion by opening 10 setuid binaries...
CVE-2002-1871
pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" question mark in the 1 mode, 2 owner, or 3 group fields, which allows attackers to elevate privileges...
Solaris 9 / 10 ld.so Local Root Exploit (2)
Exploit for solaris platform in category local exploits =========================================== Solaris 9 / 10 ld.so Local Root Exploit 2 =========================================== / Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" /...
CVE-2002-1896: Undefined Security Weakness
Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long 1 -f or 2 -o command line argument...
CVE-2002-1871: Undefined Security Weakness
pkgadd in Sun Solaris 2.5.1 through 8 installs files setuid/setgid root if the pkgmap file contains a "?" question mark in the 1 mode, 2 owner, or 3 group fields, which allows attackers to elevate privileges...
[EXPL] ePSXe Local Stack Overflow (Exploit)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
glibc, nptl, nscd security update
CentOS Errata and Security Advisory CESA-2005:256 Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by...
security flaw
GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LDDEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program...
DMA[2005-0501a] - 'ARPUS/Ce setuid buffer overflow and file overwrite'
DMA2005-0501a - 'ARPUS/Ce setuid buffer overflow and file overwrite' Author: Kevin Finisterre Vendor: http://www.swlink.net/styma/ce.shtml, http://168.158.26.15/ce/ce/ce.html Product: 'Ce/Ceterm' References: http://www.digitalmunition.com/DMA2005-0501a.txt Description: Ce/Ceterm aka. ARPUS/Ce is ...
CVE-2005-0070
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files...
