RedHat Update for automake RHSA-2014:1243-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

automake: locally exploitable "make distcheck" bug

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running "make distcheck"...

Low: Red Hat Security Advisory: automake security update

An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from...

CVE-2014-3020

install.sh in the Embedded WebSphere Application Server eWAS 7.0 before FP33 in IBM Tivoli Integrated Portal TIP 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program...

Directory traversal

install.sh in the Embedded WebSphere Application Server eWAS 7.0 before FP33 in IBM Tivoli Integrated Portal TIP 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program...

CVE-2014-3020

CVE-2014-3020 affects IBM embedded WebSphere Application Server (eWAS) 7.0 bundled with IBM Tivoli/Directory Server. An optional install script (install.sh) may grant write access to the installRoot directory, enabling local privilege escalation via a Trojan horse. IBM security bulletins describe...

Code injection

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...

CVE-2014-3499

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...

docker: systemd socket activation results in privilege escalation

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...

BMC Software Patrol <= 3.2.5 Patrol SNMP Agent File Creation/Permission Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/525/info Patrol 3.2, installed out of the box, allows for a local root compromise or denial of service. The vulnerability lies in the creation of a file by snmpagnt that is owned by the owner of the parent directory of th...

Asseco SEE iBank FX Client 2.0.9.3 - Local Privilege Escalation Vulnerability

No description provided by source. ? Asseco SEE iBank FX Client = 2.0.9.3 Local Privilege Escalation Vulnerability Vendor: Asseco SEE Product web page: http://www.asseco.com Affected version: 2.0.9.3 Build 22.06.2011 - Desktop/Enterprise Edition 1.2 1.1.5.1270 Service Pack 5 - Desktop Edition...

Oracle <= 8 8.1.5 Intelligent Agent Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/585/info A vulnerability in the Oracle Intelligent Agent allows local malicious users to execute arbitrary commands and to create world writable files as the root user. The problem lies in the dbsnmp program located in...

Joe Text Editor 2.8 .joerc Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the...

Multisoft FlagShip 4.4 Installation Permission Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1586/info A vulnerability exists in the installation of Multisoft's FlagShip 4.4 product. Some binaries are installed with world writable permissions. This may allow an attacker to alter a binary and cause other users to...

GNOME esound 0.2.19 Unix Domain Socket Race Condition Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1659/info EsounD, part of the GNOME desktop environment, is a server process allowing several applications to share the same sound hardware. Versions of esound up to and including 0.2.19 create a world-writable directory...

Oracle <= 8 8.1.5 Intelligent Agent Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/585/info A vulnerability in the Oracle Intelligent Agent allows local malicious users to execute arbitrary commands and to create world writable files as the root user. The problem lies in the dbsnmp program located in...

Excite for Web Servers 1.1 Administrative Password Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2665/info Excite for Web Servers 1.1 EWS is a search engine suite for web servers running under Windows NT and UNIX. By default the file containing the administrative password, architext.conf, is world readable and world...

CVE-2014-3431

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

Design/Logic Flaw

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

Symantec Encryption Desktop for OS X World-Writable Files Insecure File Handling

SUMMARY Symantecs Encryption Desktop for OS X installs some temporary files with world-writable attributes during installation. In a multi-user environment, a malicious user could manipulate these world-writable files to read and write files or create files with another users permissions. AFFECTE...