Linux Man Page 6.1/6.2/7.0/7.1- Source Buffer Overflow

source: https://www.securityfocus.com/bid/2872/info A buffer overflow vulnerability exists in the implementation of the 'man' system manual pager program commonly included with Linux distributions. The vulnerability exists due to the way the program handles manual page files beginning with a '.so...

KDE KFM creates temporary files insecurely

Overview KDE's kfm creates and uses temporary cache directories insecurely. Description kfm, the KDE File Manager, creates a cache directory for each user. This directory is placed in /tmp and predictably named, based on the UID. These directories are created without checking for correct ownershi...

CVE-2001-0138

privatepw program in wu-ftpd before 2.6.1-6 allows local users to overwrite arbitrary files via a symlink attack...

CVE-2001-0266

Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges...

CVE-2001-0109

rctab in SuSE 7.0 and earlier allows local users to create or overwrite arbitrary files via a symlink attack on the rctmp temporary file...

CVE-2001-0142

squid 2.3 and earlier allows local users to overwrite arbitrary files via a symlink attack in some configurations...

Samba 2.0.8 security fix

I've just released Samba 2.0.8. This release fixes a significant security vulnerability that allows local users to corrupt local devices such as raw disks. For most users the Samba Team recommends Samba 2.2.0 which has just been released. Version 2.2.0 has all the security fixes plus many new...

CVE-2001-0125

exmh 2.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the exmhErrorMsg temporary file...

CVE-2001-0132

Interscan VirusWall 3.6.x and earlier follows symbolic links when uninstalling the product, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2001-0019

Arrowpoint aka Cisco Content Services, or CSS allows local users to cause a denial of service via a long argument to the "show script," "clear script," "show archive," "clear archive," "show log," or "clear log" commands...

CVE-2001-0069

dialog before 0.9a-20000118-3bis in Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack...

FreeBSD-SA-01:12.periodic

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:12 Security Advisory FreeBSD, Inc. Topic: periodic uses insecure temporary files REVISED Category: core Module: periodic Announced: 2001-01-29 Revised: 2001-01-29 Credits...

CVE-2000-1018

shred 1.0 file wiping utility does not properly open a file for overwriting or flush its buffers, which prevents shred from properly replacing the file's data and allows local users to recover the file...

CVE-2000-0935

Samba Web Administration Tool SWAT in Samba 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file...

CVE-2000-0790

The web-based folder display capability in Microsoft Internet Explorer 5.5 on Windows 98 allows local users to insert Trojan horse programs by modifying the Folder.htt file and using the InvokeVerb method in the ShellDefView ActiveX control to specify a default execute option for the first file...

CVE-2000-0494

Veritas Volume Manager creates a world writable .serverpids file, which allows local users to add arbitrary commands into the file, which is then executed by the vmsaserver script...

CVE-2000-0722

Helix GNOME Updater helix-update 0.5 and earlier allows local users to install arbitrary RPM packages by creating the /tmp/helix-install installation directory before root has begun installing packages...

CVE-2000-0723

Helix GNOME Updater helix-update 0.5 and earlier does not properly create /tmp directories, which allows local users to create empty system configuration files such as /etc/config.d/bashrc, /etc/config.d/csh.cshrc, and /etc/rc.config...

napster.path-disclosure.txt

-------------------------------------------------- time 1:30 am date 9-18-00 affected systems: any system running napster client hasn't been tested for the gnapster client -------------------------------------------------- ADVISORY: here goes...... hi lindsay, pat, jason , and t-rex After running...

AIX 4.24.3 - netstat -Z Statistic Clearing

AIX 4.24.3 - netstat -Z Statistic Clearing source: https://www.securityfocus.com/bid/1660/info A vulnerability exists in versions 4.x. x of AIX, from IBM. Any local user can utilize the -Z command to netstat, without needing to be root. This will cause interface statistics to be reset. This could...