CVE-2008-5299 chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.
MediumCVSS 6.9
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| karakas-online chm2pdf | = 0.9 | No fix listed |
| debian/chm2pdf(Debian:10) | < 0.9.1-1.1 | 0.9.1-1.1 |
References
- bugs.debian.org
- FEDORA-2011-0467 vendor-advisory
- FEDORA-2011-0454 vendor-advisory
- 32257 third-party-advisory vendor-advisory
- 43109 third-party-advisory vendor-advisory
- 31735 vdb-entry
- ADV-2011-0236 vdb-entry vendor-advisory
- chm2pdf-chm2pdf-symlink(45813) vdb-entry