Helmut Grohne

The issue is related to the implementation of the Kerberos5 protocol in heimdal, specifically concerning incorrect validation of message integrity codes. This can allow a remote attacker to cause a logical inversion, resulting in the validation of message integrity codes in gssapi/arcfour to be inverted.

Name of the Vulnerable Software and Affected Versions: git-extras version 1.7.0 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effort. This is related to the git-changelog utility in git-extras. Recommendations: For git-extras version 1.7.0, consider restricting access to the git-changelog utility until a patch is available, and avoid using the /tmp/changelog and /tmp/.git-effort files in a way that could be exploited by a symlink attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows attackers to gain elevated privileges due to the generation of predictable file names in the /tmp directory by the generate doygen.pl script.

The issue arises from improper handling of the /tmp directory during the build process of xr, allowing a local attacker to create a world-writable subdirectory in a specific location under /tmp. The attacker can then wait for a user process to copy xr into this subdirectory and subsequently replace the contents with a Trojan horse version of xr.

The issue concerns the kamcmd administrative utility and its default configuration in Kamailio, which utilizes the /tmp/kamailio ctl directory.

The issue allows local users to gain privileges due to a problem in the kamailio build process.

The issue allows local users to overwrite arbitrary files via a symlink attack. This is due to the use of tempfile to create a safe temporary file, but appending a suffix to the original filename and writing to this new filename.

The issue is related to an insecure temporary file vulnerability. It also involves an unlimited file upload vulnerability of a dangerous type in the SIP server, which can be exploited by a remote attacker to upload or transfer untrusted files to the `/tmp/kamailio fifo` location.

The issue allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a symlink or hard link attack on certain files. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out by a local attacker.

The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file when latex2man is used with the H or T option.

The issue allows local users to cause a denial of service and possibly execute arbitrary code via user-influenceable input that cause start kdeinit to send SIGUSR1 signals to other processes. Exploitation of the vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information.