am-utils symbolic links security vulnerability

expn utility unsafe temporary files creation...

[ GLSA 200804-09 ] am-utils: Insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200804-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

am-utils: Insecure temporary file creation

Background am-utils is a collection of utilities for use with the Berkeley Automounter. Description Tavis Ormandy discovered that, when creating temporary files, the 'expn' utility does not check whether the file already exists. Impact A local attacker could exploit the vulnerability via a symlin...

Fedora 7 : centerim-4.22.4-1.fc7.1 (2008-2869)

This update fixes the CVE-2008-1467 security issue by disabling the 'actions' configuration altogether. Furthermore the default web browser is no longer configurable in CenterIM. The links get open in the default web browser configured, using xdg-utils. There won't be any update for centericq. Al...

Fedora 8 : centerim-4.22.4-1.fc8 (2008-2867)

This update fixes the CVE-2008-1467 security issue by disabling the 'actions' configuration altogether. Furthermore the default web browser is no longer configurable in CenterIM. The links get open in the default web browser configured, using xdg-utils. This release adds support for new versions ...

openSUSE 10 Security Update : libcdio (libcdio-5061)

Long file names in ISO file systems with Joliet extension could cause a buffer overflow in libcdio CVE-2007-6613. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libcdio-5061. The text...

CVE-2008-1136: Improper Input Validation

The Utils::runScripts function in src/utils.cpp in vdccm 0.92 through 0.10.0 in SynCE SynCE-dccm allows remote attackers to execute arbitrary commands via shell metacharacters in a certain string to TCP port 5679...

CVE-2008-1078

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

CVE-2008-1078

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

CVE-2008-1078

CVE-2008-1078 affects the expn component of am-utils (and related net-fs usage) on Gentoo, rPath Linux, and other distros. The issue is an insecure temporary-file handling in expn that allows a local user to perform a symlink attack on expn[PID], enabling overwriting of arbitrary files. This vuln...

CVE-2008-1078: Improper Link Resolution Before File Access

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

rPSA-2008-0088-1 am-utils

rPath Security Advisory: 2008-0088-1 Published: 2008-02-28 Products: rPath Linux 1 Rating: Minor Exposure Level Classification: Local Non-deterministic Unauthorized Access Updated Versions: am-utils=conary.rpath.com@rpl:1/6.0.9-11.4-1 rPath Issue Tracking System:...

openSUSE 10 Security Update : xdg-utils (xdg-utils-4983)

xdg-open and xdg-email didn't properly check their arguments. Therefore e.g. URLs passed to those programs could contain shell code that got executed CVE-2008-0386. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Code injection

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

CVE-2008-0386 affects xdg-utils

CVE-2008-0386: Improper Input Validation

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...