CVE-2007-0166

The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink...

CVE-2007-0166

The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink...

CVE-2007-0166

Summary: CVE-2007-0166 affects FreeBSD’s jail rc.d script. In FreeBSD 5.3 through 6.2, the host jail rc.d script did not verify pathnames when writing jail startup output to /var/log/console.log or when mounting/unmounting files, enabling a local root attacker inside the jail to overwrite host fi...

CVE-2006-6382

The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained...

CVE-2006-6382

CVE-2006-6382 affects Positive Software H-Sphere prior to 2.5.0 RC3. The control panel creates log files in a user’s directory with insecure permissions, enabling local users to append log data to arbitrary files via a symlink attack. The description notes the provenance is from third‑party infor...

CVE-2006-6382

The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained...

[SECURITY] [DSA 1205-2] New thttpd packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1205-2 [email protected] http://www.debian.org/security/ Steve Kemp December 1sd, 2006 http://www.debian.org/security/faq -...

CVE-2006-4396

The Apple Type Services ATS server in Mac OS X 10.4.8 and earlier does not securely create log files, which allows local users to create and modify arbitrary files via unspecified vectors, possibly relating to a symlink attack...

CVE-2006-4396

The Apple Type Services ATS server in Mac OS X 10.4.8 and earlier does not securely create log files, which allows local users to create and modify arbitrary files via unspecified vectors, possibly relating to a symlink attack...

USN-385-1: tar vulnerability

Teemu Salmela discovered that tar still handled the deprecated GNUTYPENAMES record type. This record type could be used to create symlinks that would be followed while unpacking a tar archive. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary fil...

Debian DSA-1216-1 : flexbackup - insecure temporary file

Eric Romang discovered that the flexbackup backup tool creates temporary files in an insecure manner, which allows denial of service through a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

[SECURITY] [DSA 1216-1] New flexbackup packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1216-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 20th, 2006 http://www.debian.org/security/faq -...

Debian DSA-1208-1 : bugzilla - several vulnerabilities

Several remote vulnerabilities have been discovered in the Bugzilla bug tracking system, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4534 Javier Fernandez-Sanguino Pena discovered that insecure...

DSA-1216 flexbackup

Bulletin has no description...

CVE-2006-5851

openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328...

CVE-2006-5851

openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328...

CVE-2006-5851

CVE-2006-5851 affects OpenBase SQL prior to 10.0.1. It enables local users to create arbitrary files via a symlink attack on the /tmp/output file, constituting a local file-creation vulnerability distinct from CVE-2006-5328. The root cause is a symlink/temporary-file handling issue in OpenBase SQ...

Xcode OpenBase <= 10.0.0 (symlink) Local Root Exploit (OSX)

No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom = ftp://www.openbase.com/pub/OpenBase10.0 vulnerable ? Create a new file anywhere on the filesystem with rw-rw-rw privs. Sorry you can NOT overwrite existing files. Writin...

security flaw

The sortoffline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files...

Debian DSA-1205-2 : thttpd - insecure temporary files

The original advisory for this issue didn't contain fixed packages for all supported architectures which are corrected in this update. For reference please find below the original advisory text : Marco d'Itri discovered that thttpd, a small, fast and secure webserver, makes use of insecure...