CVE

Id
35104  
CVE No.
CVE-2008-4987  
Status
Candidate  
Description
xastir 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the (a) /tmp/ldconfig.tmp, (b) /tmp/ldconf.tmp, and (c) /tmp/ld.so.conf temporary files, related to the (1) get-maptools.sh and (2) get_shapelib.sh scripts.  
Phase
Assigned (20081106)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
384038 35104 CVE-2008-4987 MLIST:[oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire  View
384039 35104 CVE-2008-4987 URL:http://www.openwall.com/lists/oss-security/2008/10/30/2  View
384040 35104 CVE-2008-4987 MISC:http://uvw.ru/report.lenny.txt  View
384041 35104 CVE-2008-4987 CONFIRM:http://bugs.debian.org/496383  View
384042 35104 CVE-2008-4987 CONFIRM:http://dev.gentoo.org/~rbu/security/debiantemp/xastir  View
384043 35104 CVE-2008-4987 CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=235770  View
384044 35104 CVE-2008-4987 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=460429  View
384045 35104 CVE-2008-4987 FEDORA:FEDORA-2008-7269  View
384046 35104 CVE-2008-4987 URL:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00199.html  View
384047 35104 CVE-2008-4987 FEDORA:FEDORA-2008-7541  View
384048 35104 CVE-2008-4987 URL:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00307.html  View
384049 35104 CVE-2008-4987 BID:31030  View
384050 35104 CVE-2008-4987 URL:http://www.securityfocus.com/bid/31030  View
384051 35104 CVE-2008-4987 SECUNIA:31677  View
384052 35104 CVE-2008-4987 URL:http://secunia.com/advisories/31677  View
384053 35104 CVE-2008-4987 SECUNIA:31771  View
384054 35104 CVE-2008-4987 URL:http://secunia.com/advisories/31771  View
384055 35104 CVE-2008-4987 XF:xastir-getmaptools-getshapelib-symlink(44920)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
45682 JVNDB-2008-000075 EC-CUBE における SQL インジェクションの脆弱性 株式会社ロックオンが提供する EC-CUBE には、SQL インジェクションの脆弱性が存在します。 CVE-2008-4991 35104 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000075.html  View