CVE-2008-2266 uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated b...
MediumCVSS 4.4
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may be a CVE-2004-2265 regression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nzbget | <= 0.2.2 | No fix listed |
| nzbget | = 0.1.0a | No fix listed |
| nzbget | = 0.1.1 | No fix listed |
| nzbget | = 0.1.2 | No fix listed |
| nzbget | = 0.2.0 | No fix listed |
| nzbget | = 0.2.1 | No fix listed |
| uudeview | = 0.5.20 | No fix listed |
| debian/uudeview(Debian:12) | < 0.5.20-3.1 | 0.5.20-3.1 |
| debian/uudeview(Debian:13) | < 0.5.20-3.1 | 0.5.20-3.1 |
| debian/uudeview(Debian:14) | < 0.5.20-3.1 | 0.5.20-3.1 |
References
- bugs.debian.org
- 30171 third-party-advisory vendor-advisory
- 31420 third-party-advisory vendor-advisory
- GLSA-200808-11 vendor-advisory
- [oss-security] 20080514 Re: CVE id request: uudeview mailing-list
- [oss-security] 20080530 Re: CVE id request: uudeview mailing-list
- 29211 vdb-entry
- uudeview-tempnam-symlink(42407) vdb-entry
- Debian Security Tracker CVE-2008-2266 vendor-advisory
- bugs.debian.org issue-tracking