GlusterFS: insecure temporary file creation

GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names...

PT-2012-1253 · Mendix · Mendix Runtime

Name of the Vulnerable Software and Affected Versions: Mendix Runtime V8 versions Mendix Runtime V9 versions prior to V9.24.29 Mendix Runtime V10 versions prior to V10.16.0 Mendix Runtime V10.6 versions prior to V10.6.15 Mendix Runtime V10.12 versions prior to V10.12.7 Description: A race conditi...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : munin vulnerabilities (USN-1622-1)

It was discovered that the Munin qmailscan plugin incorrectly handled temporary files. A local attacker could use this issue to possibly overwrite arbitrary files. This issue only affected Ubuntu 10.04 LTS, Ubuntu 11.10, and Ubuntu 12.04 LTS. CVE-2012-2103 It was discovered that Munin incorrectly...

Code injection

welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...

CVE-2012-5355

welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...

CVE-2012-5355

The CVE-2012-5355 issue affects xdiagnose prior to version 2.5.2ubuntu0.1. A symlink attack on a temporary file in /tmp allows local users to overwrite arbitrary files, due to a predictable temporary file name. Impact is limited to local privilege/domains where xdiagnose runs, enabling partial in...

PT-2012-5410 · Opencryptoki +1 · Opencryptoki +1

Name of the Vulnerable Software and Affected Versions: openCryptoki versions prior to 2.4.1 Description: The issue allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the .pkapi xpk or .pkcs11spinloc file in /tmp. This is possible when using...

Ubuntu Update for - xdiagnose USN-1591-1

Ubuntu Update for Linux kernel vulnerabilities USN-1591-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN15911.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for - xdiagnose USN-1591-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net...

Ubuntu 12.04 LTS : xdiagnose update (USN-1591-1)

Alec Warner discovered that xdiagnose improperly handled temporary files in welcome.py when creating user-initiated archive files. While failsafeX does not use the vulnerable code, this update removes this functionality to protect any 3rd party applications which import the vulnerable code. In th...

Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : devscripts vulnerabilities (USN-1593-1)

Raphael Geissert discovered that the debdiff.pl tool incorrectly handled shell metacharacters. If a user or automated system were tricked into processing a specially crafted filename, a remote attacker could possibly execute arbitrary code. CVE-2012-0212 Raphael Geissert discovered that the...

USN-1593-1: devscripts vulnerabilities

Raphael Geissert discovered that the debdiff.pl tool incorrectly handled shell metacharacters. If a user or automated system were tricked into processing a specially crafted filename, a remote attacher could possibly execute arbitrary code. CVE-2012-0212 Raphael Geissert discovered that the...

USN-1591-1: xdiagnose update

Alec Warner discovered that xdiagnose improperly handled temporary files in welcome.py when creating user-initiated archive files. While failsafeX does not use the vulnerable code, this update removes this functionality to protect any 3rd party applications which import the vulnerable code. In th...

Design/Logic Flaw

scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary 1 standard output or 2 standard error output file...

PT-2012-5271 · Mf · Mf Gig Calendar Plugin

Name of the Vulnerable Software and Affected Versions: MF Gig Calendar plugin version 0.9.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page, which is a cross-site scripting XSS vulnerability. This enables attackers to...

Fedora 10 : geda-gnetlist-20080929-2.fc10 (2008-10010)

CVE-2008-5148 geda-gnetlist insecure temporary file use Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

CVE-2012-3734

Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's intended 1 Data Protection level or 2 encryption state by reading the temporary content...

Design/Logic Flaw

Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's intended 1 Data Protection level or 2 encryption state by reading the temporary content...

CVE-2012-3734

Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's intended 1 Data Protection level or 2 encryption state by reading the temporary content...

RHEL 6 : java-1.7.0-ibm (RHSA-2012:1289)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1289 advisory. - OpenJDK: AWT hardening fixes AWT, 7163201 CVE-2012-0547 - Oracle JDK: unspecified vulnerability fixed in 6u33 and 7u5 Deployment...

Fedora 16 : blender-2.59-7.fc16 (2012-13665)

Fix insecure use of creating temporary file. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...