Description

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

Remediation

References

CVE-2018-12615

Related Vulnerabilities

WordPress 2.8.5 Multiple Vulnerabilities (2.8 - 2.8.5)

RubyGems Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-8324)

WordPress Plugin Catch Import Export Security Bypass (1.8)

WordPress Plugin Wow Forms-create any form with custom style SQL Injection (2.1)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4526)

Severity

Medium

Classification

CVE-2018-12615 CWE-732 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities