Ubuntu 4.10 / 5.04 : texinfo vulnerability (USN-194-1)

Frank Lichtenheld discovered that the 'texindex' program created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user running texindex. Note that Tenable Network Security has extracted the preceding...

Ubuntu 4.10 : perl vulnerabilities (USN-16-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the perl package. The utility 'instmodsh', the Perl package 'PPPort.pm', and several test scripts which are not shipped and only used during build created temporary files in an insecure way, which could allow a symlink attack to...

Ubuntu 4.10 : sharutils vulnerability (USN-104-1)

Joey Hess discovered that 'unshar' created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block...

Ubuntu 4.10 : lvm10 vulnerability (USN-15-1)

Recently, Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program 'lvmcreateinitrd' created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoki...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2005:173)

New updates are available for Mozilla Firefox : A regression in the LE2005 Firefox package caused problems with cursor movement that has been fixed. The run-mozilla.sh script, with debugging enabled, would allow local users to create or overwrite arbitrary files via a symlink attack on temporary...

Ubuntu 4.10 : GhostScript utility script vulnerabilities (USN-3-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the gs-common package. The utilities 'pv.sh' and 'ps2epsi' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Note...

Ubuntu 4.10 / 5.04 : cfengine vulnerabilities (USN-198-1)

Javier Fernandez-Sanguino Pena discovered that several tools in the cfengine package vicf, cfmailfilter, and cfcron create and use temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user...

Ubuntu 4.10 : Standard C library script vulnerabilities (USN-4-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the libc6 package. The utilities 'catchsegv' and 'glibcbug' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Not...

Ubuntu 5.04 : graphviz vulnerability (USN-208-1)

Javier Fernandez-Sanguino Pena discovered that the 'dotty' tool created and used temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running dotty. Note that Tenable Network Security h...

Ubuntu 4.10 : gettext vulnerabilities (USN-5-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the gettext package. The programs 'autopoint' and 'gettextize' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program...

Ubuntu 4.10 : debmake vulnerability (USN-49-1)

Javier Fernandez-Sanguino Pena noticed that the debstd script from debmake, a deprecated helper package for Debian packaging, created temporary directories in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the...

Ubuntu 4.10 : openssl script vulnerability (USN-24-1)

Recently, Trustix Secure Linux discovered a vulnerability in the openssl package. The auxiliary script 'derchop' created temporary files in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Note that...

Ubuntu 4.10 / 5.04 : heartbeat vulnerability (USN-165-1)

Eric Romang discovered that heartbeat created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with root privileges as soon as heartbeat is started. Note that Tenable Network Security has extracted the preceding description block...

Ubuntu 4.10 : postgresql contributed script vulnerability (USN-6-1)

Recently, Trustix Secure Linux discovered a vulnerability in the postgresql-contrib package. The script 'makeoidjoinscheck' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the script. Note...

Code injection

The ispellop function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell...

CVE-2006-0055

The ispellop function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell...

CVE-2006-0055

The ispellop function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell...

CVE-2006-0055

The ispellop function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell...

CVE-2006-0055

The CVE-2006-0055 issue affects the ee editor on FreeBSD 4.10–6.0, where the ispell_op function generates predictable temporary file names and does not verify which file is written. This race condition allows a local user to perform a symlink attack and potentially overwrite arbitrary files durin...

ee -- temporary file privilege escalation

Problem description The ispellop function used by ee1 while executing spell check operations employs an insecure method of temporary file generation. This method produces predictable file names based on the process ID and fails to confirm which path will be over written with the user. It should b...