14650 matches found
Kexec-tools Temporary File Handling Vulnerability
kexec-tools is a package containing the /sbin/kexec binary and the accompanying userspace components that make up the kernel's kexec functionality. kexec-tools insecurely creates temporary files, allowing a local attacker to manipulate arbitrary files and elevate privileges by implementing symbol...
Design/Logic Flaw
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file...
CVE-2015-0267
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file...
CVE-2015-0267
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file...
CVE-2015-0267
CVE-2015-0267 affects kexec-tools: the module-setup.sh script creates temporary files insecurely, enabling a local attacker to overwrite arbitrary files via a symlink attack. Documented impact: local privilege escalation on affected systems. Affected products/versions and patches cited in connect...
CVE-2015-0267
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file...
ICBC Internet banking assistant and other security controls was traced to the presence of the“disaster-level”vulnerability-vulnerability warning-the black bar safety net
Recently, ICBC Internet banking assistant and other security controls was traced to the presence of the“disaster-level”vulnerability, the vulnerability can cause remote arbitrary code execution on the user computer, security caused great harm. Baidu security prompts the user as soon as possible o...
CXF: Large invalid content could cause temporary space to fill
It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of dis...
Scientific Linux Security Update : kexec-tools on SL7.x x86_64 (20150512)
It was found that the module-setup.sh script provided by kexec-tools created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files. CVE-2015-0267 This update also fixes the...
kexec-tools: insecure use of /tmp/*$$* filenames
It was found that the module-setup.sh script provided by kexec-tools created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files...
open-uri-cached Gem for Ruby Temporary File Creation Elevation of Privilege Vulnerability
open-uri-cached Gem for Ruby is a Ruby-based application. open-uri-cached Gem for Ruby insecurely creates temporary files when using YAML, allowing local attackers to exploit vulnerabilities for elevated privileges...
SuSE 11.3 Security Update : emacs (SAT Patch Number 10519)
Emacs has been updated to fix the following issues : - Several cases of insecure usage of temporary files. CVE-2014-3421 / CVE-2014-3422 / CVE-2014-3423 / CVE-2014-3424 - Use of vc-annotate for renamed files when using Git. bnc854683 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
The vulnerability of the File System API interface of Google Chrome allows a remote attacker to bypass the SafeBrowsing security mechanism.
The vulnerability of the Google Chrome browser’s File System API allows a malicious actor to bypass the SafeBrowsing security mechanism for executable files. This can be achieved by creating an executable file in a temporary file system, and then accessing it using a request of the...
fedora-business-cards Insecure Temporary File Creation Vulnerability
Fedora is a Linux-based operating system developed by the Fedora Project community and sponsored by Red Hat. fedora-business-cards is a business card generator. An insecure temporary file creation vulnerability exists in fedora-business-cards, which stems from the program using an insecure way to...
SaltStack Insecure Temporary File Vulnerability
SaltStack is an open source set of tools for managing infrastructure. SaltStack has a security vulnerability due to the serverdensitydevice.py module creating the 'install.sh' temporary file in an incorrect way. This allows an attacker to perform arbitrary file operations via symbolic links...
Google Chrome FileSystem API Security Bypass Vulnerability
Google Chrome is a web browsing tool developed by Google. A security vulnerability exists in the FileSystem API of Google Chrome versions prior to 40.0.2214.91. A remote attack exploiting this vulnerability could bypass the SafeBrowsing for Executable Files protection mechanism by creating an .ex...
Moodle < 2.5 / 2.5.x < 2.5.9 / 2.6.x < 2.6.6 / 2.7.x < 2.7.3 Multiple Vulnerabilities
Binary data 8721.prm...
python-numpy symbolic links vulnerability
Symbolic links vulnerability on temporary files creation...
[ MDVSA-2015:077 ] python-numpy
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:077 http://www.mandriva.com/en/support/security/ Package : python-numpy Date : March 27, 2015 Affected: Business Server 2.0 Problem Description: Updated python-numpy packages fix security vulnerabilities: f2...
Design/Logic Flaw
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL...