CVE-2008-3699 The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_i...
LowCVSS 3.3
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amarok | = 1.4.9.1 | No fix listed |
| debian/amarok(Debian:13) | < 1.4.10-1 | 1.4.10-1 |
| debian/amarok(Debian:14) | < 1.4.10-1 | 1.4.10-1 |
References
- amarok.kde.org
- bugs.debian.org
- 31418 third-party-advisory vendor-advisory
- 31663 third-party-advisory
- 31839 third-party-advisory
- 32357 third-party-advisory
- GLSA-200809-08 vendor-advisory
- SSA:2008-241-01 vendor-advisory
- websvn.kde.org
- MDVSA-2008:172 vendor-advisory
- 30662 vdb-entry
- USN-657-1 vendor-advisory
- ADV-2008-2338 vdb-entry
- amarok-magnatunebrowser-symlink(44399) vdb-entry
- FEDORA-2008-7739 vendor-advisory
- FEDORA-2008-7719 vendor-advisory
- Debian Security Tracker CVE-2008-3699 vendor-advisory
- bugs.debian.org issue-tracking