Debian DSA-242-1 : kdebase - several vulnerabilities

The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be...

Debian DSA-234-1 : kdeadmin - several vulnerabilities

The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be...

Debian DSA-237-1 : kdenetwork - several vulnerabilities

The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be...

DSA-243 kdemultimedia - several vulnerabilities

Bulletin has no description...

DSA-239 kdesdk - several vulnerabilities

Bulletin has no description...

DSA-235 kdegraphics - several vulnerabilities

Bulletin has no description...

DSA-237 kdenetwork - several vulnerabilities

Bulletin has no description...

DSA-236 kdelibs - several vulnerabilities

Bulletin has no description...

Apple Mac OSX 10.x / FreeBSD 4.x / OpenBSD 2.x / Solaris 2.5/2.6/7.0/8 - 'exec C Library' Standard I/O File Descriptor Closure

/ source: https://www.securityfocus.com/bid/4568/info It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before execing setuid images. Consequently, I/O that are opened by a setuid process may be assigned fi...

codeblue remote root

/ Demonstration linux-x86 remote root against codeblue v1.1 from file header Otherwise it's known as CodeBlue v4 This is a rather trivial to exploit... From getsmtpreply "We'll loop infinately, receiving 1 byte at a time until we receive a carriage return or line-feed character, signifying the en...

Deserialization of Untrusted Data

Description This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation. References...