CVE

Id
68933  
CVE No.
CVE-2014-1638  
Status
Candidate  
Description
(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.  
Phase
Assigned (20140122)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
663181 68933 CVE-2014-1638 MLIST:[oss-security] 20140122 Getting tempfile/mktemp wrong  View
663182 68933 CVE-2014-1638 URL:http://www.openwall.com/lists/oss-security/2014/01/22/3  View
663183 68933 CVE-2014-1638 MLIST:[oss-security] 20140122 Re: Getting tempfile/mktemp wrong  View
663184 68933 CVE-2014-1638 URL:http://www.openwall.com/lists/oss-security/2014/01/22/4  View
663185 68933 CVE-2014-1638 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736359  View
663186 68933 CVE-2014-1638 BID:65098  View
663187 68933 CVE-2014-1638 URL:http://www.securityfocus.com/bid/65098  View
663188 68933 CVE-2014-1638 OSVDB:102379  View
663189 68933 CVE-2014-1638 URL:http://www.osvdb.org/102379  View
663190 68933 CVE-2014-1638 OSVDB:102381  View
663191 68933 CVE-2014-1638 URL:http://www.osvdb.org/102381  View
663192 68933 CVE-2014-1638 XF:localepurge-cve20141638-symlink(90669)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
13361 JVNDB-2014-002236 Symantec PGP Desktop および Encryption Desktop Professional におけるサービス運用妨害 (DoS) の脆弱性 Symantec PGP Desktop および Encryption Desktop Professional は、メモリコピーを適切に実行しないため、サービス運用妨害 (アクセス違反の読み込みおよびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-1646 68933 2.6 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002236.html  View