CVE-2008-5140 trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/opr.ini.##### or (2) /tmp/lpt*.zip te...
MediumCVSS 6.9
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/opr.ini.##### or (2) /tmp/lpt*.zip temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian mailscanner | = 4.55.10 | No fix listed |
References
- bugs.debian.org
- [debian-devel] 20080811 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages mailing-list
- 32730 third-party-advisory
- 33117 third-party-advisory vendor-advisory
- www.mailscanner.info vendor-advisory
- 32376 vdb-entry
- mailscanner-trendautoupdatenew-symlink(46725) vdb-entry