[FD] Out-of-bounds read & write in the glibc's qsort()

Qualys Security Advisory For the algorithm lovers: Nontransitive comparison functions lead to out-of-bounds read & write in glibc's qsort()

[FD] CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()

Qualys Security Advisory CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() Contents Summary Analysis Proof of concept Exploit

[FD] CVE-2023-4911: Local Privilege Escalation in the glibc's ld.so

Qualys Security Advisory Looney Tunables: Local Privilege Escalation in the glibc's ld.so (CVE-2023-4911) Contents Summary Analysis Pro

[FD] CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent

Qualys Security Advisory CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent Contents Summary Background Experiments Re

[FD] LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863

Qualys Security Advisory LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863 Contents Summary CVE-2023-33865, a symlink

[FD] Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)

Qualys Security Advisory Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) Contents Summary Backg

[FD] Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)

Qualys Security Advisory Leeloo Multipath: Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) Contents

[FD] Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)

Qualys Security Advisory Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) Contents Summary Analysis Exploitation Acknowledgments

Re: [FD] Remote Code Execution in qmail (CVE-2005-1513)

in "/var/lib/qmail/control/me" on the target machine (and hence the hostname in qmail's SMTP banner). - "server_ip": the IP address of the target machine. - "-d homedir": the home directory of the target user, if known (otherwise, the exploit uses a reas

[FD] Remote Code Execution in qmail (CVE-2005-1513)

Qualys Security Advisory 15 years later: Remote Code Execution in qmail (CVE-2005-1513) Contents Summary Analysis Exploitation qmail-verify - CVE

[FD] LPE and RCE in OpenSMTPD's default install (CVE-2020-8794)

Qualys Security Advisory LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) == Contents == Summary Analysis ... Acknowledg

[FD] Local information disclosure in OpenSMTPD (CVE-2020-8793)

Qualys Security Advisory Local information disclosure in OpenSMTPD (CVE-2020-8793) == Contents == Summary Analysis Exploitation POKE 47196

[FD] LPE and RCE in OpenSMTPD (CVE-2020-7247)

Qualys Security Advisory LPE and RCE in OpenSMTPD (CVE-2020-7247) == Contents == Summary Analysis Exploitation Acknowledgments

[FD] Local Privilege Escalation in OpenBSD's dynamic loader (CVE-2019-19726)

Qualys Security Advisory Local Privilege Escalation in OpenBSD's dynamic loader (CVE-2019-19726) == Contents == Summary Ana

[FD] Authentication vulnerabilities in OpenBSD

Qualys Security Advisory Authentication vulnerabilities in OpenBSD == Contents == 1. CVE-2019-19521: Authentication bypass 1.1. Analysis

[FD] The Return of the WIZard: RCE in Exim (CVE-2019-10149)

Qualys Security Advisory The Return of the WIZard: RCE in Exim (CVE-2019-10149) Contents Summary Local exploitation Remote exploitation - Non

Re: [FD] System Down: A systemd-journald exploit

;ssh 127.0.0.1", but alternative methods can be implemented ("utempter" and "gnome-pty-helper", for example). - To test the default information-leak method even if "No journal files were opened due to insufficient permissions", it is enough to create /var/log/

[FD] System Down: A systemd-journald exploit

Qualys Security Advisory System Down: A systemd-journald exploit Contents Summary CVE-2018-16864 - Analysis - Exploitation CVE-2018-16865

[FD] Integer overflow in Linux's create_elf_tables() (CVE-2018-14634)

Qualys Security Advisory Mutagen Astronomy: Integer overflow in Linux's create_elf_tables() (CVE-2018-14634) Contents Summary Analysis Exploit

[FD] Qualys Security Advisory - Procps-ng Audit Report

Qualys Security Advisory Procps-ng Audit Report Contents Summary 1. FUSE-backed /proc/PID/cmdline 2. Unprivileged process hiding 3. Local

[FD] Qualys Security Advisory - Buffer overflow in glibc's ld.so

Qualys Security Advisory Buffer overflow in glibc's ld.so Contents Summary Memory Leak Buffer Overflow Exploitation Acknowledg

[FD] Qualys Security Advisory - Linux PIE/stack corruption (CVE-2017-1000253)

Qualys Security Advisory Linux PIE/stack corruption (CVE-2017-1000253) Contents Summary Analysis Exploitation Acknowledgments

[FD] Qualys Security Advisory - CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux

Qualys Security Advisory CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux Contents Analysis Exploitation Example Acknowledg

[FD] Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778

Qualys Security Advisory Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 Contents Summary Information Leak (CVE-2016-0777

[FD] Qualys Security Advisory - LibreSSL (CVE-2015-5333 and CVE-2015-5334)

Qualys Security Advisory LibreSSL (CVE-2015-5333 and CVE-2015-5334) Contents Summary Memory Leak (CVE-2015-5333) Buffer Overflow (CVE-2015-5334

[FD] Qualys Security Advisory - OpenSMTPD Audit Report

(Sorry for the "CVE-2015-ABCD" place-holders in the report, but OpenSMTPD's developers were ready with the patches before MITRE was ready with the CVE-IDs.) Qualys Security Advisory OpenSMTPD Audit Report ==

[FD] Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser

Hello, it is July 23, 2015, 17:00 UTC, the Coordinated Release Date for CVE-2015-3245 and CVE-2015-3246. Please find our advisory below, and our exploit attached. Qualys Security Advisory CVE-2015-3245 userhelper chfn() newline filtering CVE-2015-3246 libuser passwd file handling

[FD] Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow

Qualys Security Advisory CVE-2015-0235 GHOST: glibc gethostbyname buffer overflow --[ Contents ] 1 - Summary 2 - Analysis 3 - Mitigating factors 4 - Case studies 5 - Exploitation 6 - Acknowledgments --[ 1 - Summary