doas Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/doas/ Sun, 26 Feb 2023 06:31:06 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png doas Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/doas/ 32 32 CVE-2019-15900 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-15900/ Sun, 26 Feb 2023 06:31:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-15900/ An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username […]

The post CVE-2019-15900 appeared first on CVE Vulnerability.

]]> An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.

The post CVE-2019-15900 appeared first on CVE Vulnerability.

]]> CVE-2019-15901 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-15901/ Sun, 26 Feb 2023 06:31:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-15901/ An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group […]

The post CVE-2019-15901 appeared first on CVE Vulnerability.

]]> An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.

The post CVE-2019-15901 appeared first on CVE Vulnerability.

]]>