ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability

ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...

FreeBSD-SA-14:07.devfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:07.devfs Security Advisory The FreeBSD Project Topic: devfs rules not applied by default for jails Category: core Module: etcrc.d Announced: 2014-04-30...

CVE-2013-6774

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...

CVE-2013-6768

Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse appprocess program via a crafted PATH environment variable for a /system/xbin/su process...

CVE-2013-6769

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

Design/Logic Flaw

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...

Code injection

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

Design/Logic Flaw

Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse appprocess program via a crafted PATH environment variable for a /system/xbin/su process...

Design/Logic Flaw

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

CVE-2013-6768

Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse appprocess program via a crafted PATH environment variable for a /system/xbin/su process...

CVE-2013-6774

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...

CVE-2013-6774

CVE-2013-6774 describes an untrusted search path vulnerability in Android Superuser implementations (ChainsDD Superuser 3.1.3, CyanogenMod/ClockWorkMod/Koush Superuser 1.0.2.1, Chainfire SuperSU before 1.69) on Android 4.2.x and earlier. The issue arises because BOOTCLASSPATH can be crafted to lo...

CVE-2013-6768

The CVE-2013-6768 entry describes an untrusted search path vulnerability in CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier. A crafted PATH for /system/xbin/su can trigger the Dalvik VM to launch a Trojan horse app_process, enabling privilege-related risk. C...

CVE-2013-6769

The CVE-2013-6769 entry concerns CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android. It describes a privilege-escalation vulnerability where attackers can gain root privileges by injecting shell metacharacters into the -c argument of /system/xbin/su. The root cause is improper h...

CVE-2013-6770

CVE-2013-6770 affects CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 on Android 4.3/4.4. The flaw lets any user with ADB shell access and a suitable Linux UID exploit /system/xbin/su --daemon to gain root privileges and create a Trojan script, due to inadequate restriction of who can ru...

PT-2014-3197

Name of the Vulnerable Software and Affected Versions CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1 Description The issue concerns the CyanogenMod/ClockWorkMod/Koush Superuser package, which does not properly restrict the set of users who can execute /system/xbin/su with the...

CVE-2013-6770: Undefined Security Weakness

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

PT-2014-3195

Name of the Vulnerable Software and Affected Versions CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1 CyanogenMod/ClockWorkMod/Koush Superuser package versions prior to 1.0.2.1 for Android 4.2.x and earlier Description The issue allows attackers to trigger the launch of a Trojan...

PT-2014-3196

Name of the Vulnerable Software and Affected Versions CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1 Description The issue allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su. This could potentially lead to unauthorized access and...

CVE-2013-6774: Undefined Security Weakness

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...