CVSS: 2.1EPSS: 0%CPEs: 17EXPL: 0CVE-2012-5530
https://notcve.org/view.php?id=CVE-2012-5530
The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file. Las secuencias de comandos (1) pcmd y (2) pmlogger en Performance Co-Pilot (PCP) v3.6.10, permite a usuarios locales sobrescribir archivos de su elección a través de un ataque de enlace simbólico en un archivo temporal /var/tmp/##### • http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html http://www.securityfocus.com/bid/56656 https://bugzilla.novell.com/show_bug.cgi?id=782967 https://bugzilla.redhat.com/show_bug.cgi?id=875842 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2012-3419
https://notcve.org/view.php?id=CVE-2012-3419
Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments. Performance Co-Pilot (PCP) anterior a v3.6.5 realiza exportaciones de algunos de los sistema de archivos /proc, que permite a los atacantes obtener información confidencial, como proc / pid / maps y los argumentos de línea de comandos. • http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6 http://www.debian.org/security/2012/dsa-2533 http://www.openwall.com/lists/oss-security/2012/08/16/1 https://b • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 9%CPEs: 13EXPL: 0CVE-2012-3420
https://notcve.org/view.php?id=CVE-2012-3420
Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative type value to the __pmGetPDU function in libpcp/src/pdu.c. Múltiples pérdidas de memoria en Performance Co-Pilot (PCP) anterior a v3.6.5 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria o un accidente demonio) a través de un gran número de PDUs con (1) un número de contexto diseñado al función en DoFetch pmcd / src / dofetch.c o (2) un valor de tipo negativo para la función pmGetPDU __ en libpcp / src / pdu.c. • http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6 http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=68fb968b4ee635bb301dc9ab64e633b0d66d27b4 http://oss.sgi.com • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 4%CPEs: 13EXPL: 0CVE-2012-3421
https://notcve.org/view.php?id=CVE-2012-3421
The pduread function in pdu.c in libpcp in Performance Co-Pilot (PCP) before 3.6.5 does not properly time out connections, which allows remote attackers to cause a denial of service (pmcd hang) by sending individual bytes of a PDU separately, related to an "event-driven programming flaw." La función pduread en pdu.c en libpcp en Performance Co-Pilot (PCP) anterior a v3.6.5 no realiza el tiempo de espera de conexiones, permitiendo a atacantes remotos provocar una denegación de servicio (pmcd bloquea) mediante el envío de bytes individuales de una PDU por separado , en relación a un "defecto de programación orientada a eventos." • http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6 http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=9ba85dca940de976176ce196fd5e3c4170936354 http://www.debian.org& •
CVSS: 5.0EPSS: 10%CPEs: 13EXPL: 0CVE-2012-3418
https://notcve.org/view.php?id=CVE-2012-3418
libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a PDU with the numcreds field value greater than the number of actual elements to the __pmDecodeCreds function in p_creds.c; (2) the string byte number value to the __pmDecodeNameList function in p_pmns.c; (3) the numids value to the __pmDecodeIDList function in p_pmns.c; (4) unspecified vectors to the __pmDecodeProfile function in p_profile.c; the (5) status number value or (6) string number value to the __pmDecodeNameList function in p_pmns.c; (7) certain input to the __pmDecodeResult function in p_result.c; (8) the name length field (namelen) to the DecodeNameReq function in p_pmns.c; (9) a crafted PDU_FETCH request to the __pmDecodeFetch function in p_fetch.c; (10) the namelen field in the __pmDecodeInstanceReq function in p_instance.c; (11) the buflen field to the __pmDecodeText function in p_text.c; (12) PDU_INSTANCE packets to the __pmDecodeInstance in p_instance.c; or the (13) c_numpmid or (14) v_numval fields to the __pmDecodeLogControl function in p_lcontrol.c, which triggers integer overflows, heap-based buffer overflows, and/or buffer over-reads. libpcp en Performance Co-Pilot (PCP) anterior a v3.6.5 permite a atacantes remotos provocar una denegación de servicio y posiblemente ejecutar código arbitrario a través de (1) una PDU con el valor del campo numcreds mayor que el número de elementos reales de la función __ pmDecodeCreds en p_creds.c, (2) el byte de valor de cadena número a la función pmDecodeNameList __ en p_pmns.c, (3) el valor numids a la función pmDecodeIDList __ en p_pmns.c; (4) vectores no especificados a la función pmDecodeProfile __ en p_profile.c; el (5) estado de valor o número (6) valor numérico cadena a la función __ pmDecodeNameList en p_pmns.c, (7) de entrada determinado en la función __ pmDecodeResult en p_result.c, (8) el campo longitud del nombre (namelen) a la DecodeNameReq en función p_pmns.c; (9) una solicitud PDU_FETCH diseñados a la función pmDecodeFetch __ en p_fetch.c; (10) el campo namelen en la función __ pmDecodeInstanceReq en p_instance.c; (11) el campo buflen a la función pmDecodeText __ en p_text. c; (12) PDU_INSTANCE paquetes a la __ pmDecodeInstance en p_instance.c; o los campos (13) c_numpmid o (14) v_numval a la función pmDecodeLogControl __ en p_lcontrol.c, que desencadena desbordamientos de enteros, basado en heap desbordamientos de búfer, y / o tampón sobre-lee. • http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6 http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=b441980d53be1835b25f0cd6bcc0062da82032dd http://oss.sgi.com • CWE-189: Numeric Errors •