CVE-2005-3342 noweb 2.10c and earlier allows local users to overwrite arbitrary files via symlink attacks on temporary files in (1) lib/toascii.nw and (2) shell/roff.mm.
LowCVSS 1.2
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
noweb 2.10c and earlier allows local users to overwrite arbitrary files via symlink attacks on temporary files in (1) lib/toascii.nw and (2) shell/roff.mm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| norman ramsey noweb | = 2.9a | No fix listed |
| norman ramsey noweb | = 2.10c | No fix listed |
| debian/noweb(Debian:12) | < 2.10c-3.2 | 2.10c-3.2 |
| debian/noweb(Debian:13) | < 2.10c-3.2 | 2.10c-3.2 |
| debian/noweb(Debian:14) | < 2.10c-3.2 | 2.10c-3.2 |
References
- 18809 third-party-advisory vendor-advisory
- 18812 patch third-party-advisory vendor-advisory
- 18967 patch third-party-advisory vendor-advisory
- 19027 third-party-advisory vendor-advisory
- DSA-968 patch vendor-advisory
- GLSA-200602-14 vendor-advisory
- 16610 vdb-entry
- USN-254-1 vendor-advisory
- ADV-2006-0547 vdb-entry
- Debian Security Tracker CVE-2005-3342 vendor-advisory