Code injection

PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac LUM 6.2094 through 6.4102 and other products, allows local users to 1 truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and 2...

CVE-2007-4998

CVE-2007-4998 is a local, user‑assisted vulnerability in cp when preserving symlinks across multiple OSes. The issue allows an attacker to cause a race/symlink attack that can overwrite arbitrary files by crafting directories with multiple source files copied to the same destination. Multiple con...

CVE-2008-0525

PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac LUM 6.2094 through 6.4102 and other products, allows local users to 1 truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and 2...

CVE-2008-0525

CVE-2008-0525 affects PatchLink Update client for Unix (used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac LUM 6.2094–6.4102 and related products). The root cause is local symlink abuse in scripts that use temporary files: /tmp/patchlink.tmp (logtrimmer) can be truncated, an...

CVE-2008-0525

PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac LUM 6.2094 through 6.4102 and other products, allows local users to 1 truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and 2...

Two vulnerabilities for PatchLink Update Client for Unix.

PatchLink Update Unix Client File clobbering vulnerability Larry W. Cashdollar Vapid Labs 1/17/2008 Overview From the vendor: “PatchLink Update™ provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of...

patchlink-pwn.txt

PatchLink Update Unix Client File clobbering vulnerability Larry W. Cashdollar Vapid Labs 1/17/2008 Overview From the vendor: “PatchLink Update™ provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of...

Debian Security Advisory DSA 661-2 (f2c)

The remote host is missing an update to f2c announced via advisory DSA 661-2. OpenVAS Vulnerability Test $Id: deb6612.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 661-2 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 707-1 (mysql)

The remote host is missing an update to mysql announced via advisory DSA 707-1. OpenVAS Vulnerability Test $Id: deb7071.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 707-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1187-1 (migrationtools)

The remote host is missing an update to migrationtools announced via advisory DSA 1187-1. Jason Hoover discovered that migrationtools, a collection of scripts to migrate user data to LDAP creates several temporary files insecurely, which might lead to denial of service through a symlink attack...

Debian Security Advisory DSA 610-1 (cscope)

The remote host is missing an update to cscope announced via advisory DSA 610-1. OpenVAS Vulnerability Test $Id: deb6101.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 610-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 002-1 (fsh)

The remote host is missing an update to fsh announced via advisory DSA 002-1. OpenVAS Vulnerability Test $Id: deb0021.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 002-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 011-1 (mgetty)

The remote host is missing an update to mgetty announced via advisory DSA 011-1. OpenVAS Vulnerability Test $Id: deb0111.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 011-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1208-1 (bugzilla)

The remote host is missing an update to bugzilla announced via advisory DSA 1208-1. Several remote vulnerabilities have been discovered in the Bugzilla bug tracking system, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following...

Debian Security Advisory DSA 603-1 (openssl)

The remote host is missing an update to openssl announced via advisory DSA 603-1. OpenVAS Vulnerability Test $Id: deb6031.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 603-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1156-1 (kdebase)

The remote host is missing an update to kdebase announced via advisory DSA 1156-1. Ludwig Nussel discovered that kdm, the X display manager for KDE, handles access to the session type configuration file insecurely, which may lead to the disclosure of arbitrary files through a symlink attack...

Debian Security Advisory DSA 1216-1 (flexbackup)

The remote host is missing an update to flexbackup announced via advisory DSA 1216-1. Eric Romang discovered that the flexbackup backup tool creates temporary files in an insecure manner, which allows denial of service through a symlink attack. OpenVAS Vulnerability Test $Id: deb12161.nasl 6616...

Debian Security Advisory DSA 1205-2 (thttpd)

The remote host is missing an update to thttpd announced via advisory DSA 1205-2. Marco d'Itri discovered that thttpd, a small, fast and secure webserver, makes use of insecure temporary files when its logfiles are rotated, which might lead to a denial of service through a symlink attack. The...

Debian: Security Advisory (DSA-636-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-588-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...