CVE-2008-4098

mysql: incomplete upstream fix for CVE-2008-2079

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

CVSS 2.0 · 4.6 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Mysql and 2 more

Products

Ubuntu Linux Debian Linux Mysql and 2 more

CVE-2008-4101

vim: arbitrary code execution in commands: K, Control-], g]

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

CVSS 2.0 · 9.3 Critical EPSS 9.2% KEV · Not listed

Vendors

Redhat Vim

Products

Enterprise Linux Vim

CVE-2008-4190

openswan: Insecure auxiliary /tmp file usage (symlink attack possible)

The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.

CVSS 2.0 · 4.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Openswan Redhat Xelerance

Products

Openswan Enterprise Linux Openswan

CVE-2008-4192

cman/fence: insecure temporary file usage in the egenera fence agent

The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cman Enterprise Linux Rhel Cluster

CVE-2008-4210

kernel: open() call allows setgid bit when user is not in new file's group

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVSS 2.0 · 4.6 Medium EPSS 2.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2008-4225

libxml2: integer overflow leading to infinite loop in xmlBufferResize

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

CVSS 2.0 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Libxml

CVE-2008-4226

libxml2: integer overflow leading to memory corruption in xmlSAX2Characters

Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.

CVSS 2.0 · 10.0 Critical EPSS 4.1% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Libxml

CVE-2008-4302

kernel: splice: fix bad unlock_page() in error case

fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux

CVE-2008-4306

enscript: "font" special escape buffer overflows

Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence.

CVSS 2.0 · 9.3 Critical EPSS 2.4% KEV · Not listed

Vendors

Redhat Ubuntu

Products

Enterprise Linux Linux

CVE-2008-4307

Kernel BUG() in locks_remove_flock

Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock, related to improper handling of a race between fcntl and close in the EINTR case.

CVSS 2.0 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2008-4316

glib2: integer overflows in the base64 handling functions (oCERT-2008-015)

Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Enterprise Linux

CVE-2008-4310

ruby: Incomplete fix for CVE-2008-3656

httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.

CVSS 2.0 · 7.8 High EPSS 13.6% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2008-4313

tog-pegasus: WBEM services access not restricted to dedicated user after 2.7.0 rebase

A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.

CVSS 2.0 · 6.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Openpegasus Redhat

Products

Openpegasus Wbem Enterprise Linux Enterprise Linux Desktop

CVE-2008-4315

tog-pegasus: failed authentication attempts not logged via PAM

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.

CVSS 2.0 · 6.8 Medium EPSS 2.7% KEV · Not listed

Vendors

Openpegasus Redhat

Products

Openpegasus Wbem Enterprise Linux Enterprise Linux Desktop

CVE-2008-4405

xen: Multiple unsafe uses of guest-writable data from xenstore

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.

CVSS 2.0 · 7.2 High EPSS 1.0% KEV · Not listed

Vendors

Citrix Redhat

Products

Xen Enterprise Linux

CVE-2008-4456

mysql: mysql command line client XSS flaw

Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.

CVSS 2.0 · 2.6 Low EPSS 7.0% KEV · Not listed

Vendors

Mysql Oracle Redhat

Products

Mysql Mysql Enterprise Linux

CVE-2008-4552

nfs-utils: incorrect use of tcp_wrappers, causing hostname-based rules to be ignored

The good_client function in nfs-utils 1.0.9, and possibly other versions before 1.1.3, invokes the hosts_ctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions.

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Nfs Redhat

Products

Nfs-utils Enterprise Linux

CVE-2008-4554

kernel: don't allow splice() to files opened with O_APPEND

The do_splice_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2008-4576

kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH

sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init timer expires.

CVSS 2.0 · 7.8 High EPSS 3.7% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2008-4577

dovecot: incorrect handling of negative rights in the ACL plugin

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Canonical Dovecot Fedoraproject and 2 more

Products

Ubuntu Linux Dovecot Fedora and 2 more