Murray Mcallister

The issue allows remote attackers to execute arbitrary code with root privileges due to world-writable permissions on the /tmp directory.

The issue is related to the insecure creation of temporary files, resulting in predictable filenames.

The issue concerns the `vmw gb surface define ioctl` function, accessible via the `DRM IOCTL VMW GB SURFACE CREATE` ioctl call, which does not properly initialize a `backup handle` variable. This allows local users to obtain sensitive information from uninitialized kernel memory by creating a GB surface with a previously allocated DMA buffer as a backup buffer, and then making a crafted ioctl call.

The issue is caused by an integer overflow in the `vc4 get bcl` function of the VideoCore DRM driver. This can be exploited by a local attacker using a specially crafted `VC4 SUBMIT CL` ioctl call with a malicious size value, potentially leading to a denial of service or other unspecified impacts.

Name of the Vulnerable Software and Affected Versions: Snoopy (affected versions not specified) Description: The issue in Snoopy allows remote attackers to execute arbitrary commands due to an incomplete fix. This is related to the ` httpsrequest` function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

The issue concerns a crafted Byzanz debug data recording (ByzanzRecording file) that can be used to cause a denial of service or possibly execute arbitrary code when played back using the byzanz-playback command. This is due to an out-of-bounds heap write in the GIF encoder.

The issue is related to multiple integer overflows that allow remote attackers to cause a denial of service, resulting in a crash. This is achieved by exploiting large dimensions in a BMP image, which triggers a buffer overflow.

The issue is related to multiple buffer overflows that can be triggered by a crafted PBM image. This can cause a denial of service (crash) or possibly allow the execution of arbitrary code. The buffer overflows are related to (1) stream line data, which triggers a heap-based buffer overflow, and (2) vectors related to an internal intermediate heap-based buffer.

The issue is caused by a buffer overflow in the vararg functions in ldo.c, allowing context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments. This can be exploited by a remote attacker using a large number of variable-length arguments.

The issue is related to multiple integer overflows in libgfortran, which could allow remote attackers to execute arbitrary code or cause a denial of service, resulting in a Fortran application crash. This is achieved through vectors related to array allocation.

The issue is related to a function `cache invalidate` in the `mod cache` module. It allows remote HTTP servers to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereference. This occurs when a caching forward proxy is enabled and a missing hostname value is triggered. The estimated number of potentially affected devices is not provided.

The issue allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.

The issue allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.##### file in the include/tests webservers component of Lynis.

The issue allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area in the `/admin/structure/flags/import` API endpoint. This could potentially be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.

The issue is related to an integer overflow in the `check section` function within the libdw library, used by elfutils. This overflow can be triggered by a malformed compressed debug section in an ELF file, leading to a heap-based buffer overflow. As a result, remote attackers may cause a denial of service, such as an application crash, or potentially execute arbitrary code.

The issue allows remote IPP printers to execute arbitrary commands via shell metacharacters in the model or PDL, related to System V interface scripts generated for queues. This can lead to a violation of confidentiality, integrity, and availability of protected information.

The issue allows remote attackers to execute arbitrary SQL commands via unspecified parameters to various functions, including `mc project get attachments` in `api/soap/mc project api.php`, `news get limited rows` in `core/news api.php`, and several functions in `core/summary api.php` and `plugins/MantisGraph/core/graph api.php`. This is related to the use of the `db query` function.

The issue involves multiple vulnerabilities in the cups-filters package that can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, there are multiple integer overflows in the pdftoopvp filter, which can allow remote attackers to execute arbitrary code via a crafted PDF file, triggering a heap-based buffer overflow.

The issue affects the LiveConnect implementation, allowing local users to intercept communication between a Java applet and a web browser. This is achieved by pre-creating a temporary socket file with a predictable name in /tmp, enabling the user to read the messages exchanged between the applet and the browser.

The issue allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory when fwsnort is not running as root.