Back to search
CVE-2014-1638
Published: Jan 28, 2014
Modified: Aug 6, 2024
PUBLISHED
Description
(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
[oss-security] 20140122 Re: Getting tempfile/mktemp wrong
mailing-list
x_refsource_MLIST
102379
vdb-entry
x_refsource_OSVDB
localepurge-cve20141638-symlink(90669)
vdb-entry
x_refsource_XF
65098
vdb-entry
x_refsource_BID
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359
x_refsource_CONFIRM
102381
vdb-entry
x_refsource_OSVDB
[oss-security] 20140122 Getting tempfile/mktemp wrong
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now