CVE-2005-3149

Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIMVANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges...

Qpopper poppassd shared library privilege escalation

User can specify shared library path for suid application...

util-linux: umount command validation error

Background util-linux is a suite of useful Linux programs including umount, a program used to unmount filesystems. Description When a regular user mounts a filesystem, they are subject to restrictions in the /etc/fstab configuration file. David Watson discovered that when unmounting a filesystem...

GLSA-200509-08 : Python: Heap overflow in the included PCRE library

The remote host is affected by the vulnerability described in GLSA-200509-08 Python: Heap overflow in the included PCRE library The 're' Python module makes use of a private copy of libpcre which is subject to an integer overflow leading to a heap overflow see GLSA 200508-17. Impact : An attacker...

VisualBoyAdvanced 1.7.x - Non SUID Local Shell

VisualBoyAdvanced 1.7.x - Non SUID Local Shell / VisualBoyAdvanced 1.7.x BufferOver Flow exploit VBA - WEBSITE : vba.ngemu.com Found & coded by Qnix - Qnixatbsdmaildotorg / include char shellcode = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80" / setuid /...

Adobe Version Cue multiple vulnerabilities

Executable files are writable. It's possible to attach user's library to suid executable. Symbolic links problem...

Multiple ESRI ArcGIS GIS software vulnerabilities

Buffer overflows in different suid utilities...

CVE-2004-1031

fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to bypass access restrictions and load an arbitrary configuration file by starting an suid process and pointing the fcronsighup configuration file to a /proc entry that is owned by root but modifiable by the user,...

GLSA-200502-13 : Perl: Vulnerabilities in perl-suid wrapper

The remote host is affected by the vulnerability described in GLSA-200502-13 Perl: Vulnerabilities in perl-suid wrapper perl-suid scripts honor the PERLIODEBUG environment variable and write to that file with elevated privileges CAN-2005-0155. Furthermore, calling a perl-suid script with a very...

perl PERLIO_DEBUG privilege escalation

By using PERLIODEBUG variable it's possible to redirect debug output of suid application to any file. Oversized PERLIODEBUG causes buffer overflow...

MacOS X Apple iSync buffer overflow

Buffer overflow on -a argument parsing in suid root mRouter binary...

kstars -- exploitable set-user-ID application fliccd

A KDE Security Advisory explains: Overview KStars includes support for the Instrument Neutral Distributed Interface INDI. The build system of this extra 3rd party software contained an installation hook to install fliccd part of INDI as SUID root application. Erik Sjölund discovered that the code...

GLSA-200412-09 : ncpfs: Buffer overflow in ncplogin and ncpmap

The remote host is affected by the vulnerability described in GLSA-200412-09 ncpfs: Buffer overflow in ncplogin and ncpmap Karol Wiesek discovered a buffer overflow in the handling of the '-T' option in the ncplogin and ncpmap utilities, which are both installed as SUID root by default. Impact : ...

AdobeMac.txt

Note: Sorry if this is a dupe, I might of sent it to the wrong address. Local root exploit on Mac OS X 10.3.6 with Adobe products installed Found by Jonathan Bringhurst Summary: It's possible to create a suid root shell with a non-privileged user on a Mac OS X 10.3.6 system with Adobe Version Cue...

Local root exploit on Mac OS X with Adobe Version Cue

Note: Sorry if this is a dupe, I might of sent it to the wrong address. Local root exploit on Mac OS X 10.3.6 with Adobe products installed Found by Jonathan Bringhurst [email protected] Summary: It's possible to create a suid root shell with a non-privileged user on a Mac OS X 10.3.6 syst...

CVE-2004-1031

CVE-2004-1031 affects Fcron (notably 2.0.1 and 2.9.4) and potentially earlier versions. The issue allows a local user to bypass access restrictions and load an arbitrary fcron configuration file by starting a setuid process and pointing the fcronsighup configuration file at a /proc entry owned by...

Debian DSA-039-1 : glibc

The version of GNU libc that was distributed with Debian GNU/Linux 2.2 suffered from 2 security problems : - It was possible to use LDPRELOAD to load libraries that are listed in /etc/ld.so.cache, even for suid programs. This could be used to create and overwrite files which a user should not be...

os-x/PPC create /tmp/suid 122 bytes

os-x/PPC create /tmp/suid 122 bytes. Shellcode exploit for osxppc platform / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does open; write; close; exit; See ASM below. 122 Bytes. / char shellcode = "\x7c\xa5\x2a\x79\x40\x82\xff\xfd" "\x7f\xe8\x02\xa6\x39\x1f\x01\x71" "\x39\x08\xfe\xf4\x7c\xa8\x29\xa...

os-x/PPC create /tmp/suid 122 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does open; write; close; exit; See ASM below. 122 Bytes. / char shellcode = "\x7c\xa5\x2a\x79\x40\x82\xff\xfd" "\x7f\xe8\x02\xa6\x39\x1f\x01\x71" "\x39\x08\xfe\xf4\x7c\xa8\x29\xae" "\x38\x7f\x01\x68\x38\x63\xfe\xf4"...

os-x/PPC create /tmp/suid 122 bytes

Exploit for os-x/ppc platform in category shellcode =================================== os-x/PPC create /tmp/suid 122 bytes =================================== / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does open; write; close; exit; See ASM below. 122 Bytes. / char shellcode =...