Unhandled

paging

request

is

observed

due

to

dereferencing

an

already

freed

object

because

of

race

condition

between

sparse

free

and

sparse

bind

ioctls

which

access

the

same

physical

entry

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell

Saipan


A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process resulting in a potentially exploitable crash and a sandbox escape. *Note: this vulnerability only affects Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7 Firefox < 67 and Firefox ESR < 60.7.


In RubyGem excon before 0.71.0 there was a race condition around persistent connections where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data returning content from the previous response. The race condition window appears to be short and it would be difficult to purposefully exploit this.


The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.


An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2 version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.


During the initialization of a new content process a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.


Under certain conditions when checking the Resist Fingerprinting preference during device orientation checks a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3 Firefox ESR < 68.3 and Firefox < 71.


Under certain conditions when retrieving a document from a DocShell in the antitracking code a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3 Firefox ESR < 68.3 and Firefox < 71.


A race condition existed when reading and writing user preferences. This was addressed with improved state handling. This issue is fixed in macOS Catalina 10.15. The \Share Mac Analytics\ setting may not be disabled when a user deselects the switch to share analytics.


Adobe Acrobat and Reader versions 2019.012.20040 and earlier 2017.011.30148 and earlier 2017.011.30148 and earlier 2015.006.30503 and earlier and 2015.006.30503 and earlier have a race condition vulnerability. Successful exploitation could lead to arbitrary code execution .


The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.


Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed related to (1) the polkit_unix_process_new API function (2) the dbus API or (3) the --process (unix-process) option for authorization to pkcheck.


Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions which allows local users to read the file and obtain sensitive information such as \authentication secrets.\


spice-gtk 0.14 and possibly other versions invokes the polkit authority using the insecure polkit_unix_process_new API function which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


libvirt 1.0.5.x before 1.0.5.6 0.10.2.x before 0.10.2.8 and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


systemd does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees


Multiple race conditions in HtmlCleaner before 2.6 as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations.


Passcode Lock in Apple iOS before 7 does not properly manage the lock state which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.


Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges and consequently read the contents of arbitrary kernel memory locations via a crafted application a different vulnerability than other CVEs listed in MS13-016.


apt-xapian-index before 0.45ubuntu2.1 0.44ubuntu7.1 and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges and consequently read the contents of arbitrary kernel memory locations via a crafted application a different vulnerability than other CVEs listed in MS13-016.


Race condition in the kernel in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application that leverages incorrect handling of objects in memory aka \Kernel Race Condition Vulnerability \ a different vulnerability than CVE-2013-1279.


Race condition in the kernel in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory aka \Kernel Race Condition Vulnerability.\


Race condition in the kernel in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application that leverages incorrect handling of objects in memory aka \Kernel Race Condition Vulnerability \ a different vulnerability than CVE-2013-1278.


The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.


backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.


dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3 0.92.9 before 0.92.9.3 and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory aka \Win32k Race Condition Vulnerability.\


usb-creator 0.2.47 before 0.2.47.1 0.2.40 before 0.2.40ubuntu2 and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


language-selector 0.110.x before 0.110.1 0.90.x before 0.90.1 and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1 and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process a related issue to CVE-2013-4288.


Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory aka \Win32k Race Condition Vulnerability.\


Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file which might allow local users to bypass intended access permissions while compression is occurring.


Race

condition

in

in

HawtJNI

before

when

a

custom

library

path

is

not

specified

allows

local

users

to

execute

arbitrary

Java

code

by

overwriting

a

temporary

JAR

file

with

a

predictable

name

in

/tmp.


Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux creates a configuration file with world-readable permissions before restricting the permissions which allows local users to read the file and obtain sensitive information such as credentials.


A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a race condition in the spritebud daemon which could let a local malicious user obtain root privileges.


A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.


A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.


When Web Render components were destructed a race condition could have caused undefined behavior and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.


arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.


Signatures are written to disk before and read during verification which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10.


.A flaw was found in the CAN BCM networking protocol in the Linux kernel where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.


A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs there is a race condition on the managed machine. A malicious non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.


A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.


A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add() hci_sock_blacklist_del() hci_get_conn_info() hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.


Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


A Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization) vulnerability in the firewall process (dfwd) of Juniper Networks Junos OS allows an attacker to bypass the firewall rule sets applied to the input loopback filter on any interfaces of a device. This issue is detectable by reviewing the PFE firewall rules as well as the firewall counters and seeing if they are incrementing or not. For example: show firewall Filter: __default_bpdu_filter__ Filter: FILTER-INET-01 Counters: Name Bytes Packets output-match-inet 0 0 <<<<<< missing firewall packet count This issue affects: Juniper Networks Junos OS 14.1X53 versions prior to 14.1X53-D53 on QFX Series; 14.1 versions 14.1R1 and later versions prior to 15.1 versions prior to 15.1R7-S6 on QFX Series PTX Series; 15.1X53 versions prior to 15.1X53-D593 on QFX Series; 16.1 versions prior to 16.1R7-S7 on QFX Series PTX Series; 16.2 versions prior to 16.2R2-S11 16.2R3 on QFX Series PTX Series; 17.1 versions prior to 17.1R2-S11 17.1R3-S2 on QFX Series PTX Series; 17.2 versions prior to 17.2R1-S9 17.2R3-S3 on QFX Series PTX Series; 17.3 versions prior to 17.3R2-S5 17.3R3-S7 on QFX Series PTX Series; 17.4 versions prior to 17.4R2-S9 17.4R3 on QFX Series PTX Series; 18.1 versions prior to 18.1R3-S9 on QFX Series PTX Series; 18.2 versions prior to 18.2R2-S6 18.2R3-S3 on QFX Series PTX Series; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3-S1 on QFX Series PTX Series; 18.4 versions prior to 18.4R1-S5 18.4R2-S3 18.4R2-S7 18.4R3 on QFX Series PTX Series; 19.1 versions prior to 19.1R1-S4 19.1R2-S1 19.1R3 on QFX Series PTX Series; 19.2 versions prior to 19.2R1-S3 19.2R2 on QFX Series PTX Series.


When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command \show interfaces <> extensive\ and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ <<< incorrect if user ARP Policer was applied on an AE interface and the default ARP Policer is displayed Policer: Input: jtac-arp-ae5.317-inet-arp <<< correct if user ARP Policer was applied on an AE interface For all platforms except SRX Series: This issue affects Juniper Networks Junos OS: All versions 5.6R1 and all later versions prior to 18.4 versions prior to 18.4R2-S9 18.4R3-S9 with the exception of 15.1 versions 15.1R7-S10 and later versions; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; This issue does not affect Juniper Networks Junos OS versions prior to 5.6R1. On SRX Series this issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R2-S9 18.4R3-S9; 19.4 versions prior to 19.4R3-S4; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. This issue does not affect 18.4 versions prior to 18.4R1 on SRX Series. This issue does not affect Junos OS Evolved.


A signal handler race condition exists in the Layer 2 Address Learning Daemon (L2ALD) of Juniper Networks Junos OS due to the absence of a specific protection mechanism to avoid a race condition which may allow an attacker to bypass the storm-control feature on devices. This issue is a corner case and only occurs during specific actions taken by an administrator of a device under certain specifics actions which triggers the event. The event occurs less frequently on devices which are not configured with Virtual Chassis configurations and more frequently on devices configured in Virtual Chassis configurations. This issue is not specific to any particular Junos OS platform. An Indicator of Compromise (IoC) may be seen by reviewing log files for the following error message seen by executing the following show statement: show log messages | grep storm Result to look for: /kernel: GENCFG: op 58 (Storm Control Blob) failed; err 1 (Unknown) This issue affects: Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49 on EX Series; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D191 15.1X49-D200 on SRX Series; 16.1 versions prior to 16.1R7-S7; 16.2 versions prior to 16.2R2-S11 16.2R3; 17.1 versions prior to 17.1R2-S11 17.1R3; 17.2 versions prior to 17.2R2-S8 17.2R3-S3; 17.3 versions prior to 17.3R2-S5 17.3R3-S7; 17.4 versions prior to 17.4R2-S9 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R2-S6 18.2R3; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3; 18.4 versions prior to 18.4R1-S5 18.4R2; 19.1 versions prior to 19.1R1-S4 19.1R2.


By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installation process a local user can perform a privilege escalation attack to obtain administrator privileges for the purpose of executing arbitrary code through insecure use of predictable temporary file locations.


A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.


The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.


The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server TIBCO JasperReports Server TIBCO JasperReports Server TIBCO JasperReports Server TIBCO JasperReports Server - Community Edition TIBCO JasperReports Server - Developer Edition TIBCO JasperReports Server for AWS Marketplace TIBCO JasperReports Server for ActiveMatrix BPM and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below TIBCO JasperReports Server: versions 7.5.0 and 7.5.1 TIBCO JasperReports Server: version 7.8.0 TIBCO JasperReports Server: version 7.9.0 TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.


There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal.


There is a multiple threads race condition vulnerability in Huawei product. A race condition exists for concurrent I/O read by multiple threads. An attacker with the root permission can exploit this vulnerability by performing some operations. Successful exploitation of this vulnerability may cause the system to crash. Affected product versions include: ManageOne 6.5.1.SPC200 8.0.0 8.0.0-LCND81 8.0.0.SPC100 8.0.1 8.0.RC2 8.0.RC3 8.0.RC3.SPC100;SMC2.0 V600R019C10SPC700 V600R019C10SPC702 V600R019C10SPC703 V600R019C10SPC800 V600R019C10SPC900 V600R019C10SPC910 V600R019C10SPC920 V600R019C10SPC921 V600R019C10SPC922 V600R019C10SPC930 V600R019C10SPC931


There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Huawei Smartphone. Successful exploitation of these vulnerabilities may escalate the permission to that of the root user.


On BIG-IP version 16.0.x before 16.0.1.1 15.1.x before 15.1.2 14.1.x before 14.1.3.1 and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.


A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.


A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the detection result is tampered with.


There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to motionhub crash.


There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user root privilege escalation.


Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components.


There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected.


A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115.


There is a issue that trustlist strings being repeatedly inserted into the linked list in Huawei Smartphone due to race conditions. Successful exploitation of this vulnerability can cause exceptions when managing the system trustlist.


Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.


A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests.


There is a issue that nodes in the linked list being freed for multiple times in Huawei Smartphone due to race conditions. Successful exploitation of this vulnerability can cause the system to restart.


Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface.


Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.


crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0 the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap this can cause double free and a memory leak. If not this still can cause a logical bug. Crates using `Stealer::steal` `Stealer::steal_batch` or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.


net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.


An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).


The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot \.\ this can bypass extension control implemented in the plugin. Moreover there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.


The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.


A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type=\file\>) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88.


A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files a race condition could cause an object to be released before being operated on leading to NULL pointer deference condition and causing the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.


On PTX1000 System PTX10002-60C System after upgrading to an affected release a Race Condition vulnerability between the chassis daemon (chassisd) and firewall process (dfwd) of Juniper Networks Junos OS may update the device's interfaces with incorrect firewall filters. This issue only occurs when upgrading the device to an affected version of Junos OS. Interfaces intended to have protections may have no protections assigned to them. Interfaces with one type of protection pattern may have alternate protections assigned to them. Interfaces intended to have no protections may have protections assigned to them. These firewall rule misassignments may allow genuine traffic intended to be stopped at the interface to propagate further potentially causing disruptions in services by propagating unwanted traffic. An attacker may be able to take advantage of these misassignments. This issue affects Juniper Networks Junos OS on PTX1000 System: 17.2 versions 17.2R1 and later versions prior to 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R1-S8 18.4R2-S8 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R2-S6 19.3R3-S3; 19.4 versions prior to 19.4R2-S4 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R2-S3 20.2R3; 20.3 versions prior to 20.3R2-S1 20.3R3; 20.4 versions prior to 20.4R1-S1 20.4R2. This issue does not affect Juniper Networks Junos OS prior to version 17.2R1 on PTX1000 System. This issue affects Juniper Networks Junos OS on PTX10002-60C System: 18.2 versions 18.2R1 and later versions prior to 18.4 versions prior to 18.4R3-S9; 19.1 versions later than 19.1R1 prior to 19.4 versions prior to 19.4R2-S5 19.4R3-S5; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions 20.4R1 and later versions prior to 21.1 versions prior to 21.1R2; 21.2 versions 21.2R1 and later versions prior to 21.3 versions prior to 21.3R2. This issue does not affect Juniper Networks Junos OS prior to version 18.2R1 on PTX10002-60C System. This issue impacts all filter families (inet inet6 etc.) and all loopback filters. It does not rely upon the location where a filter is set impacting both logical and physical interfaces.


The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition leading to password disclosure.


A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.


Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.


An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled a crash condition can (depending on a race condition) cause an internal user with administrator privileges @ns_server to have its credentials leaked in cleartext in the ns_server.info.log file.


Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition a local user can delete arbitrary files as root. This involves the -oP and -oPX options.


Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music


Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


There is a race condition vulnerability in the binder driver subsystem in the kernel.Successful exploitation of this vulnerability may affect kernel stability.


Race condition in IPFilter firewall 3.4.3 and earlier when configured with overlapping \return-rst\ and \keep state\ rules allows remote attackers to bypass access restrictions.


Multiple race conditions in (1) certain rules and (2) argument copying during VM protection in CerbNG for FreeBSD 4.8 allow local users to defeat system call interposition and possibly gain privileges or bypass auditing as demonstrated by modifying command lines in log-exec.cb.


Race condition in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain information for forms from other sites via unknown vectors related to \page transitions\ in Safari.


Race condition in ircu 2.10.12.01 through 2.10.12.05 allows remote attackers to set a new Apass during a netburst by arranging for ops privilege to be granted before the mode arrives.


Race condition in nss_ldap when used in applications that are linked against the pthread library and fork after a call to nss_ldap might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned but other applications might also be affected.


PHP 4.x and 5.x before 5.2.1 when running on multi-threaded systems does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access.


Race condition in the NeatUpload ASP.NET component 1.2.11 through 1.2.16 1.1.18 through 1.1.23 and trunk.379 through trunk.445 allows remote attackers to obtain other clients' HTTP responses via multiple simultaneous requests which triggers multiple calls to HttpWorkerRequest.FlushResponse for the same HttpWorkerRequest object and causes a buffer to be reused for a different request.


Multiple

unspecified

vulnerabilities

in

Oracle

Database

have

unknown

impact

and

remote

authenticated

attack

vectors

related

to

Rules

Manager

and

Expression

Filter

components

and

Oracle

Streams

Note:

as

of

Oracle

has

not

disputed

reliable

claims

that

is

for

a

race

condition

in

the

trigger

in

the

Rules

Manager

and

Expression

Filter

components

changing

the

AUTHID

of

a

package

from

DEFINER

to

after

a

TRUNCATE

call

and

is

for

SQL

injection

in

the

DBMS_APPLY_USER_AGENT.SET_REGISTRATION_HANDLER

procedure

which

is

later

passed

to

the

procedure

aka

\Oracle

Streams\.


The LLTD Responder in Microsoft Windows Vista does not send the Mapper a response to a DISCOVERY packet if another host has sent a spoofed response first which allows remote attackers to spoof arbitrary hosts via a network-based race condition aka the \Total Spoof\ attack.


The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator as demonstrated by privilege escalation from Read Mode to Write Mode.


Undercover.app/Contents/Resources/uc in Rixstep Undercover allows local users to overwrite arbitrary files probably related to a race condition.


Race condition in recursive directory deletion with the (1) -r or (2) -R option in rm in Solaris 8 through 10 before 20070208 allows local users to delete files and directories as the user running rm by moving a low-level directory to a higher level as it is being deleted which causes rm to chdir to a \..\ directory that is higher than expected possibly up to the root file system a related issue to CVE-2002-0435.


Multiple race conditions in Smb4K before 0.8.0 allow local users to (1) modify arbitrary files via unspecified manipulations of Smb4K's lock file which is not properly handled by the remove_lock_file function in core/smb4kfileio.cpp and (2) add lines to the sudoers file via a symlink attack on temporary files which isn't properly handled by the writeFile function in core/smb4kfileio.cpp.


Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism and consequently write to files in arbitrary locations via an NTFS junction attack a similar issue to CVE-2014-0568.


In TrustZone a time-of-check time-of-use race condition could potentially exist in an authentication routine in all Android releases from CAF using the Linux kernel.


The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window related to a race condition or (2) after an xattr-replacement attempt that fails because the data does not fit.


In the Embedded File System in all Android releases from CAF using the Linux kernel a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.


Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.


Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.


Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5 when exist_ok is set to true and multiple threads are used might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.


eDeploy has tmp file race condition flaws


The MCollective aes_security plugin as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3 does not properly validate new server certificates based on the CA certificate which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.


Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.


Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request aka Bug ID CSCuj66766.


Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively aka Bug ID CSCuf66202.


Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20 9.0.x before 9.0.16 9.1.x before 9.1.12 9.2.x before 9.2.7 and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.


Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended workstation on which screen locking had been attempted.


Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.


Race condition in the client in IBM Tivoli Storage Manager (TSM) 5.4.0.0 through 5.4.3.6 5.5.0.0 through 5.5.4.3 6.1.0.0 through 6.1.5.6 6.2 before 6.2.5.4 6.3 before 6.3.2.3 6.4 before 6.4.2.1 and 7.1 before 7.1.1 on UNIX and Linux allows local users to obtain root privileges via unspecified vectors.


Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.


Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.


KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process related to CVE-2013-4288 and \PID reuse race conditions.\


Race condition in NVMap in NVIDIA Tegra Linux Kernel 3.10 allows local users to gain privileges via a crafted NVMAP_IOC_CREATE IOCTL call which triggers a use-after-free error as demonstrated by using a race condition to escape the Chrome sandbox.


Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.


Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case but not other cases).


Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update 25 and 1.4.2_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.


Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe and consequently gain privileges via vectors involving knowledge of the name of this named pipe in conjunction with use of the ImpersonateNamedPipeClient function.


Race condition in workspace/krunner/lock/lockdlg.cc in the KRunner lock module in kdebase in KDE SC 4.4.0 allows physically proximate attackers to bypass KScreenSaver screen locking and access an unattended workstation by pressing the Enter key at a certain time related to multiple forked processes.


Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files and consequently gain privileges by blocking the removal of a certain directory that contains a control socket related to improper interaction with ksm.


Race condition in GNU nano before 2.2.4 when run by root to edit a file that is not owned by root allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.


Race condition in Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch allows physically proximate attackers to bypass intended passcode requirements and pair a locked device with a computer and access arbitrary data via vectors involving the initial boot.


** DISPUTED ** Race condition in Avira Premium Security Suite 10.0.0.536 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in G DATA TotalCare 2010 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in McAfee Total Protection 2010 10.0.580 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


Race condition in Comodo Internet Security before 4.1.149672.916 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack.


** DISPUTED ** Race condition in Webroot Internet Security Essentials 6.1.0.145 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Panda Internet Security 2010 15.01.00 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Security Shield 2010 13.0.16.313 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in VirusBuster Internet Security Suite 3.2 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in PC Tools Firewall Plus 6.0.0.88 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Sophos Endpoint Security and Control 9.0.5 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: the vendor disputes this issue because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Kaspersky Internet Security 2010 9.0.0.736 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Norman Security Suite PRO 8.0 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in CA Internet Security Suite Plus 2010 6.0.0.272 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in DefenseWall Personal Firewall 3.00 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Online Armor Premium 4.0.0.35 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in VBA32 Personal 3.12.12.4 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Outpost Security Suite Pro 6.7.3.3063.452.0726 and 7.0.3330.505.1221 BETA on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Trend Micro Internet Security Pro 2010 17.50.1647.0000 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in 3D EQSecure Professional Edition 4.2 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in F-Secure Internet Security 2010 10.00 build 246 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Malware Defender 2.6.0 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in BitDefender Total Security 2010 13.0.20.347 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in ThreatFire 4.7.0.17 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in avast! Internet Security 5.0.462 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in ESET Smart Security 4.2.35.3 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in KingSoft Personal Firewall 9 Plus 2009.05.07.70 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Blink Professional 4.6.1 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Dr.Web Security Space Pro 6.0.0.03100 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Symantec Norton Internet Security 2010 17.5.0.127 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Online Solutions Security Suite 1.5.14905.0 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


** DISPUTED ** Race condition in Prevx 3.0.5.143 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection via certain user-space memory changes during hook-handler execution aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.


Race condition in Apple iOS 4.0 through 4.1 for iPhone 3G and later allows physically proximate attackers to bypass the passcode lock by making a call from the Emergency Call screen then quickly pressing the Sleep/Wake button.


Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux VMware Player 3.1.x before 3.1.2 build 301548 on Linux VMware Server 2.0.2 on Linux and VMware Fusion 3.1.x before 3.1.2 build 332101 allows host OS users to gain privileges via vectors involving temporary files.


Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.


In the Linux kernel before 5.17.3 fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however the race condition perhaps can only be exploited infrequently.


There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.


The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply which could allow any authenticated user to quickly raise their rating or lower the rating of other users


file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.


jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.


Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6 and Application FW <= 2.91.2.66 allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of this vulnerability is that the remote attacker could gain full remote access to the IP camera and the underlying Linux system with root permissions. With root access to the camera's Linux OS an attacker could effectively change the code that is running add backdoor access or invade the privacy of the user by accessing the live camera stream.


Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11 Zulip is vulnerable to a race condition during account deactivation where a simultaneous access by the user being deactivated may in rare cases allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will as a side effect deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds.


HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17 1.1.11 and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18 1.1.12 and 1.2.6


Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions leading to privilege escalation because of a race condition.


A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0) SCALANCE W1788-2 EEC M12 (All versions < V3.0.0) SCALANCE W1788-2 M12 (All versions < V3.0.0) SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle resources of ARP requests. This could allow an attacker to cause a race condition that leads to a crash of the entire device.


b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that in certain conditions can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. SDK users of the SqliteAccountInfo format are vulnerable while users of the InMemoryAccountInfo format are safe. The SqliteAccountInfo saves API keys (and bucket name-to-id mapping) in a local database file ($XDG_CONFIG_HOME/b2/account_info ~/.b2_account_info or a user-defined path). When first created the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory containing the file is readable by a local attacker then during the brief period between file creation and permission modification a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Consumers of this SDK who rely on it to save data using SqliteAccountInfo class should upgrade to the latest version of the SDK. Those who believe a local user might have opened a handle using this race condition should remove the affected database files and regenerate all application keys. Users should upgrade to b2-sdk-python 1.14.1 or later.


B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that in certain conditions can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/account_info` `~/.b2_account_info` or a user-defined path) when `b2 authorize-account` is first run. This happens regardless of whether a valid key is provided or not. When first created the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory is readable by a local attacker and the user did not yet run `b2 authorize-account` then during the brief period between file creation and permission modification a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Users that have not yet run `b2 authorize-account` should upgrade to B2 Command-Line Tool v3.2.1 before running it. Users that have run `b2 authorize-account` are safe if at the time of the file creation no other local users had read access to the local configuration file. Users that have run `b2 authorize-account` where the designated path could be opened by another local user should upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate all application keys. Note that `b2 clear-account` does not remove the database file and it should not be used to ensure that all open handles to the file are invalidated. If B2 Command-Line Tool cannot be upgraded to v3.2.1 due to a dependency conflict a binary release can be used instead. Alternatively a new version could be installed within a virtualenv or the permissions can be changed to prevent local users from opening the database file.


Rust is a multi-paradigm general-purpose programming language designed for performance and safety especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries) as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.


Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2 when at least one account has a blank password allows attackers to bypass password authentication and obtain login access to an arbitrary account via unspecified vectors.


The mm_for_maps function in fs/proc/base.c in the Linux kernel 2.6.30.4 and earlier allows local users to read (1) maps and (2) smaps files under proc/ via vectors related to ELF loading a setuid process and a race condition.


Race condition in the file transfer functionality in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 allows remote attackers to read sensitive files and prevent client updates by connecting to the file transfer port before the expected client does.


Race condition in the ptrace_attach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACE_ATTACH ptrace call during an exec system call that is launching a setuid application related to locking an incorrect cred_exec_mutex object.


Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.


Race condition in PulseAudio 0.9.9 0.9.10 and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link related to the application setting LD_BIND_NOW to 1 and then calling execv on the target of the /proc/self/exe symlink.


Niels Provos Systrace 1.6f and earlier on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall related to race conditions that occur in monitoring 64-bit processes.


The (1) dist or (2) distcheck rules in GNU Automake 1.11.1 1.10.3 and release branches branch-1-4 through branch-1-9 when producing a distribution tarball for a package that uses Automake assign insecure permissions (777) to directories in the build tree which introduces a race condition that allows local users to modify the contents of package files introduce Trojan horse programs or conduct other attacks before the build is complete.


dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0 and then access a potentially reuse an already opened VPS console.


Race condition in Mozilla Firefox allows remote attackers to produce a JavaScript message with a spoofed domain association by writing the message in between the document request and document load for a web page in a different domain.


Absolute Computrace Agent as distributed on certain Dell Inspiron systems through 2009 has a race condition with the Dell Client Configuration Utility (DCCU) which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted TaskResult.xml file.


Multiple race conditions in the handling of O_DIRECT in Linux kernel prior to version 2.4.22 could cause stale data to be returned from the disk when handling sparse files or cause incorrect data to be returned when a file is truncated as it is being read which might allow local users to obtain sensitive data that was originally owned by other users a different vulnerability than CVE-2003-0018.


The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown.


Race condition in SDBINST for SAP database 7.3.0.29 creates critical files with world-writable permissions before initializing the setuid bits which allows local attackers to gain root privileges by modifying the files before the permissions are changed.


Race condition in SSH Tectia Server 4.0.3 and 4.0.4 for Unix when the password change plugin (ssh-passwd-plugin) is enabled allows local users to obtain the server's private key.


A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.


Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1 when using in-memory session replication or replicated stateful session beans causes the same buffer to be provided to two users which could allow one user to see session data that was intended for another user.


A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded which allows remote attackers to spoof the URL in the address bar via the window.open and location.replace HTML parameters which facilitates phishing attacks.


Opera offers an Open button to verify that a user wishes to execute a downloaded file which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking Open via a request for a different mouse or keyboard action very shortly before the Open dialog appears. NOTE: this is a different issue than CVE-2005-2407.


Race condition in SuSE Linux 8.1 through 9.2 when run on SMP systems that have more than 4GB of memory could allow local users to read unauthorized memory from \foreign memory pages.\


A \missing serialization\ error in the unix_dgram_recvmsg function in Linux 2.4.27 and earlier and 2.6.x up to 2.6.9 allows local users to gain privileges via a race condition.


Race condition in Linux kernel 2.6 allows local users to read the environment variables of another process that is still spawning via /proc/.../cmdline.


Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world which allows local users to delete arbitrary files and directories and possibly read files and directories via a symlink attack.


It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of arbitrary programs with \NT AUTHORITY\\SYSTEM\ privileges.


The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides.


A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2 iOS 11.2 macOS High Sierra 10.13.2 Security Update 2017-002 Sierra and Security Update 2017-005 El Capitan watchOS 4.2. An application may be able to gain elevated privileges.


In xt_qtaguid.c there is a race condition due to insufficient locking. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-65853158.


In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions there is a possible use after free due to a race condition if the user frees the buffer while it's being used in another thread. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 8.1. Android ID: A-38118127.


yadm (yet another dotfile manager) 1.10.0 has a race condition (related to the behavior of git commands in setting permissions for new files and directories) which potentially allows access to SSH and PGP keys.


A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length resulting in the remaining data being written beyond the end of a statically-allocated buffer.


The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition which allows guest OS users to obtain Xen privileges aka XSA-219.


Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition which allows remote attackers to obtain sensitive user information by reading a GUI crash report.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the \Security\ component. A race condition allows attackers to bypass intended entitlement restrictions for sending XPC messages via a crafted app.


The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check time of use). With this authorization method the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.


Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.


An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. A local-privilege-escalation race condition in pbx_exchange can occur when a local user connects to a socket before permissions are secured.


NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to a race condition which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android ID: A-38045794. References: N-CVE-2017-6262.


Due to a race condition in MDSS rotator in Android for MSM Firefox OS for MSM and QRD Android before 2017-10-20 a double free vulnerability may potentially exist when two threads free the same perf structures.


Due to a race condition while processing the power stats debug file to read status a double free condition can occur in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free a different vulnerability than CVE-2017-6346.


Due to a race condition in a bus driver a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges.


DISPUTED

The

UpdraftPlus

plugin

through

for

WordPress

allows

remote

PHP

code

execution

because

the

function

in

has

a

race

condition

before

deleting

a

file

associated

with

the

name

parameter.

NOTE:

the

vendor

reports

that

this

does

not

cross

a

privilege

boundary.


Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac Windows and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.


A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default.


In GNU Coreutils through 8.29 chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \-R -L\ options which allows local users to modify the ownership of arbitrary files by leveraging a race condition.


Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.


There is a race condition in Android for MSM Firefox OS for MSM and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the camera driver the function \msm_ois_power_down\ is called without a mutex and a race condition can occur in variable \*reg_ptr\ of sub function \msm_camera_config_single_vreg\.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel two concurrent threads/processes can write the value of \0\ to the debugfs file that controls ipa ipc log which will lead to the double-free in ipc_log_context_destroy(). Another issue is the Use-After-Free which can happen due to the race condition when the ipc log is deallocated via the debugfs call during a log print.


Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory errors by leveraging definition of g2d_lock and g2d_unlock lock macros as no-ops aka SVE-2015-4598.


Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2 when using the ML2 plugin or the security groups AMQP API allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.


Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.


Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.


Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.


Race condition in the object-group ACL feature in Cisco IOS 15.5(2)T and earlier allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching aka Bug ID CSCun21071.


Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file which allows local users to bypass the intended access restrictions.


Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.


Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04 before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10 before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.


Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.


Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux Adobe AIR before 17.0.0.172 Adobe AIR SDK before 17.0.0.172 and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to bypass the Internet Explorer Protected Mode protection mechanism via unspecified vectors.


Race condition in kext tools in Apple OS X before 10.10.4 allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation.


Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress and the ownership is changed but the setuid bit is not yet stripped.


Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory which allows local users to gain privileges by writing to an update file after the signature is validated.


In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel.


In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel.


Race condition in Linux kernel 2.6.17.4 and earlier allows local users to gain root privileges by using prctl with PR_SET_DUMPABLE in a way that causes /proc/self/environ to become setuid root.


Race condition in articles/BitArticle.php in Bitweaver 1.3 when run on Apache with the mod_mime extension allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions which are stored for a small period of time under the webroot in the temp/articles directory.


Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) admin.php (2) ecrire.php and (3) lire.php. NOTE: it was later reported that the ecrire.php vector also affects 1.2. NOTE: this issue might be limited to a race condition during installation or an improper installation since a completed installation creates an include file that prevents external control of the $lang variable.


Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1 when Prompt is configured in Security Settings uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking an object or pressing keys that are actually applied to a \Yes\ approval for executing the control.


Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.


The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.


Race condition in the Xsession script as used by X Display Manager (xdm) in NetBSD before 20060212 X.Org before 20060225 and Solaris 8 through 10 before 20061006 causes a user's Xsession errors file to have weak permissions before a chmod is performed which allows local users to read Xsession errors files of other users.


Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink mkdir and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system as demonstrated by symlinking a symlink into a subdirectory to point to a parent directory via .. (dot dot) sequences and then unlinking the resulting symlink.


The VirusScan On-Access Scan component in McAfee VirusScan Enterprise 7.1.0 and Scan Engine 4.4.00 allows local privileged users to bypass security restrictions and disable the On-Access Scan option by opening the program via the task bar and quickly clicking the Disable button possibly due to an interface-related race condition.


archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.


Race condition in ptrace in Linux kernel 2.4 and 2.2 allows local users to gain privileges by using ptrace to track and modify a running setuid process.


Race condition in the UFS and EXT2FS file systems in FreeBSD 4.2 and earlier and possibly other operating systems makes deleted data available to user processes before it is zeroed out which allows a local user to access otherwise restricted information.


Race condition in partmgr.sys in Windows Partition Manager in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that makes multiple simultaneous Plug and Play (PnP) Configuration Manager function calls aka \Plug and Play (PnP) Configuration Manager Vulnerability.\


Race condition in LoginUIFramework in Apple Mac OS X 10.7.x before 10.7.4 when the Guest account is enabled allows physically proximate attackers to login to arbitrary accounts by entering the account name and no password.


Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory.


The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory which allows local users to read arbitrary files via a race condition.


Race condition in Tunnelblick 3.3beta20 and earlier allows local users to kill unintended processes by waiting for a specific PID value to be assigned to a target process.


Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.


Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check.


libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.


A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race condition leads to a local authentication bypass. The exploit has been disclosed to the public and may be used.


A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.