CVE-2018-13054

CVE-2018-13054 affects Cinnamon 1.9.2–3.8.6 where cinnamon-settings-users.py runs as root and can overwrite any user’s ~/.face via symlink pointing to an arbitrary location, enabling a possible privilege escalation. Connected advisories (openSUSE, Fedora, SUSE, Mageia, Ubuntu) report a fix for th...

Directory Traversal

rubyzip is vulnerable to directory traversal attacks. A malicious user can pass zip file containing files with the / character or a zip file with a symlink to cause a directory traversal. This is related to CVE-2017-5946...

Security Bulletin: PowerKVM is affected by a kexec-tools vulnerability (CVE-2015-0267)

Summary PowerKVM is affected by a kexec-tools vulnerability CVE-2015-0267. Vulnerability Details CVEID: CVE-2015-0267 DESCRIPTION: kexec-tools could allow a local attacker to launch a symlink attack. The script module-setup.sh creates temporary files insecurely. A local attacker could exploit thi...

Security Bulletin: PowerKVM is affected by ppc64-diag and powerpc-utils vulnerabilities (Multiple CVEs)

Summary PowerKVM is affected by multiple vulnerabilities in ppc64-diag and powerpc-utils. Vulnerability Details CVEID: CVE-2014-4038 DESCRIPTION: ppc64-diag could allow a local attacker to launch a symlink attack. lpdelatest.sh creates temporary files insecurely. A local attacker could exploit th...

Security Bulletin: Samba vulnerability affects IBM Storwize V7000 Unified (CVE-2017-2619)

Summary IBM Storwize V7000 Unified is shipped with Samba, for which a fix is available for security vulnerability. Vulnerability Details Samba is used in IBM Storwize V7000 Unified to enable file management and authentication services for Microsoft Windows environments. CVEID: CVE-2017-2619...

Security Bulletin: Samba vulnerability affects IBM SONAS (CVE-2017-2619)

Summary IBM SONAS is shipped with Samba, for which a fix is available for security vulnerability. Vulnerability Details Samba is used in IBM SONAS to enable file management and authentication services for Microsoft Windows environments. CVEID: CVE-2017-2619 DESCRIPTION: Samba could allow a remote...

Security Bulletin: Multiple vulnerabilities in PHP as used by IBM QRadar Incident Forensics 7.2 MR2. (CVE-2014-3515, CVE-2014-4049, CVE-2014-3981, CVE-2014-0238, CVE-2014-0237, CVE-2014-4721)

Summary The PHP language version used by IBM QRadar Incident Forensics 7.2 MR2 contains multiple vulnerabilities. Vulnerability Details CVE ID: CVE-2014-3515 DESCRIPTION: PHP could allow a remote attacker to execute arbitrary code on the system, caused by a type confusion when performing an...

ALPINE-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

Design/Logic Flaw

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

DEBIAN-CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2018-10380

CVE-2018-10380 affects kwallet-pam in KDE KWallet prior to 5.12.6, where local users can exploit a symlink to obtain ownership of arbitrary files. The vulnerability stems from insecure permission handling in the PAM module, enabling local privilege elevation with complete confidentiality, integri...

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack...

CVE-2013-0159

The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg...

Design/Logic Flaw

The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg...

CVE-2013-0159

The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg...

CVE-2013-0159

The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg...

CVE-2013-0159

CVE-2013-0159 affects the Fedora package fedora-business-cards on Fedora 17/18 prior to the patched releases. The vulnerability arises from an insecure temporary file creation leading to a symlink attack on /tmp/fedora-business-cards-buffer.svg, enabling a local attacker to cause a denial of serv...