CVE-2008-0673 TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decline the request, which allows remote attackers to truncate ar...
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decline the request, which allows remote attackers to truncate arbitrary files in the top level of a home directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tintin++ | = 1.97.9 | No fix listed |
| tintin wintin++ | = 1.97.9 | No fix listed |
| debian/tintin++(Debian:12) | < 1.97.9-2 | 1.97.9-2 |
| debian/tintin++(Debian:13) | < 1.97.9-2 | 1.97.9-2 |
| debian/tintin++(Debian:14) | < 1.97.9-2 | 1.97.9-2 |
References
- aluigi.altervista.org
- 28833 third-party-advisory vendor-advisory
- GLSA-201111-07 vendor-advisory
- 3632 third-party-advisory
- 20080206 Chat vulnerabilities in TinTin++ 1.97.9 mailing-list
- 27660 vdb-entry
- ADV-2008-0449 vdb-entry
- Debian Security Tracker CVE-2008-0673 vendor-advisory
- bugs.debian.org issue-tracking