Design/Logic Flaw

The kernfsxread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call...

CVE-2005-3356

The mqopen system call in Linux kernel 2.6.9, in certain situations, can decrement a counter twice "double decrement" as a result of multiple calls to the mntput function when the dentryopen function call fails, which allows local users to cause a denial of service panic via unspecified attack...

USN-231-1: Linux kernel vulnerabilities

Rudolf Polzer reported an abuse of the 'loadkeys' command. By redefining one or more keys and tricking another user like root into logging in on a text console and typing something that involves the redefined keys, a local user could cause execution of arbitrary commands with the privileges of th...

[SECURITY] [DSA 922-1] New Linux 2.6.8 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 922-1 [email protected] http://www.debian.org/security/ Martin Schulze December 14th, 2005 http://www.debian.org/security/faq -...

DSA-922-1 kernel-source-2.6.8 - several

Bulletin has no description...

solaris/sparc setreuid/execve 56 bytes

No description provided by source. / [email protected] setreuid shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode = "\x90\x1A\x40\x09" / xor %o1, %o1, %o0 / "\x92\x1A\x40\x09" / xor %o1, %o1, %o1 / "\x82\x10\x20\xCA" /...

CVE-2002-2180

OpenBSD 2.0–3.1 setitimer(2) syscall contains input validation issues that allow a local user to write to kernel memory and potentially gain root privileges. The root cause is described as an argument-check problem, possibly related to an integer signedness error. Affected component: setitimer(2)...

FreeBSD-SA-05:17.devfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:17.devfs Security Advisory The FreeBSD Project Topic: devfs ruleset bypass Category: core Module: devfs Announced: 2005-07-20 Credits: Robert Watson Affects:...

CVE-2005-1768

The CVE-2005-1768 issue is a race condition in the Linux kernel’s IA32 (x86) compatibility execve() handling, affecting amd64/Intel EM64T and Itanium platforms. A concurrent thread can increment a pointer count after nargs has counted pointers but before copying from user space to kernel space, l...

CVE-2005-1768

Race condition in the ia32 compatibility code for the execve system call in Linux kernel 2.4 before 2.4.31 and 2.6 before 2.6.6 allows local users to cause a denial of service kernel panic and possibly execute arbitrary code via a concurrent thread that increments a pointer count after the nargs...

CVE-2002-1668

The vulnerability CVE-2002-1668 affects HP-UX 11.11 and earlier. It allows local users to trigger a denial of service (kernel deadlock) via a file-system weakness potentially exploited by mmap() and performing I/O using data from the mapped buffer on the mapped file descriptor. The available sour...

CVE-2005-1880

everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget...

CVE-2005-1879

LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget...

elfcd1.txt

!/bin/bash elfcd.sh warning: This code will crash your machine cat elfcd1.c / Linux binfmtelf core dump buffer overflow Copyright c 2005 iSEC Security Research. All Rights Reserved. THIS PROGRAM IS FOR EDUCATIONAL PURPOSES ONLY IT IS PROVIDED "AS IS" AND WITHOUT ANY WARRANTY. COPYING, PRINTING,...

CVE-2005-0973

Unknown vulnerability in the setsockopt system call in Mac OS X 10.3.9 and earlier allows local users to cause a denial of service memory exhaustion via crafted arguments...

CVE-2005-0971

Stack-based buffer overflow in the semop system call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments...

CVE-2005-0971

Stack-based buffer overflow in the semop system call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments...

RHEL 3 : kernel (RHSA-2005:293)

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

kernel security update

CentOS Errata and Security Advisory CESA-2005:293 Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...