UBUNTU-CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

DEBIAN-CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

Security update for postgresql95 (important)

This update for postgresql95 fixes the following issues: Upate to PostgreSQL 9.5.11: Security issues fixed: https://www.postgresql.org/docs/9.5/static/release-9-5-11.html CVE-2018-1053, boo1077983: Ensure that all temporary files made by pgupgrade are non-world-readable. boo1079757: Rename...

openSUSE Security Update : postgresql96 (openSUSE-2018-203)

This update for postgresql96 to version 9.6.7 fixes the following issues : - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983 A full changelog is available here : https://www.postgresql.org/docs/9.6/static/release-9-6-7.html This update was...

katello-debug: Possible symlink attacks due to use of predictable file names

A flaw was found in katello-debug where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files...

SUSE-SU-2018:0506-1 Security update for postgresql94

This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.16, full release notes: https://www.postgresql.org/docs/9.4/static/release-9-4-16.html Security issues fixed: - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable...

SUSE-SU-2018:0507-1 Security update for postgresql96

This update for postgresql96 to version 9.6.7 fixes the following issues: - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983 A full changelog is available here: https://www.postgresql.org/docs/9.6/static/release-9-6-7.html...

FreeBSD : PostgreSQL vulnerabilities (c602c791-0cf4-11e8-a2ec-6cc21735f730)

The PostgreSQL project reports : - CVE-2018-1052: Fix the processing of partition keys containing multiple expressions only for PostgreSQL-10.x - CVE-2018-1053: Ensure that all temporary files made with 'pgupgrade' are non-world-readable C Tenable Network Security, Inc. The descriptive text and...

Debian DLA-1271-1 : postgresql-9.1 security update

A vulnerabilities has been found in the PostgreSQL database system : CVE-2018-1053 Tom Lane discovered that pgupgrade, a tool used to upgrade PostgreSQL database clusters, creates temporary files containing password hashes that are world-readable. For Debian 7 'Wheezy', this problem has been fixe...

lighttpd < 1.4.28 Insecure Temporary File Creation

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.28. Therefore, it may be, affected by the following vulnerability : - The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a...

PT-2018-3993

Name of the Vulnerable Software and Affected Versions Django versions 1.11.8 through 1.11.9 Django versions 2.0 through 2.0.1 Description The issue is related to the confirm login allowed method in django.contrib.auth.forms.AuthenticationForm, which allows remote attackers to obtain potentially...

PostgreSQL vulnerabilities

The PostgreSQL project reports: CVE-2018-1052: Fix the processing of partition keys containing multiple expressions only for PostgreSQL-10.x CVE-2018-1053: Ensure that all temporary files made with "pgupgrade" are non-world-readable...

Ubuntu 14.04 LTS / 16.04 LTS : w3m vulnerabilities (USN-3555-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3555-1 advisory. It was discovered that w3m incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. CVE-2018-619...

USN-3555-2: w3m vulnerabilities

USN-3555-2 fixed vulnerabilities in w3m. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that w3m incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. CVE-2018-6196, CVE-2018-6197 It...

USN-3555-1: w3m vulnerabilities

It was discovered that w3m incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. CVE-2018-6196, CVE-2018-6197 It was discovered that w3m incorrectly handled temporary files. An attacker could possibly use this to overwrite arbitrary files...

USN-3555-1 w3m vulnerabilities

It was discovered that w3m incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. CVE-2018-6196, CVE-2018-6197 It was discovered that w3m incorrectly handled temporary files. An attacker could possibly use this to overwrite arbitrary files...

CVE-2011-2902

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name...

Code injection

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name...

DEBIAN-CVE-2011-2902

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name...

CVE-2011-2902

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name...