CVE-2010-4337 The configure script in gnash 0.8.8 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/gnash-configure-errors.$$, (2) /tmp/gnash-configure-warnings.$$, or (3) /tmp/gn...

LowCVSS 3.3 EPSS 0.34%

Published: 2011-01-15 00:00
Updated: 2026-06-17 02:24
Exploit status: No public exploit known

Description

The configure script in gnash 0.8.8 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/gnash-configure-errors.$$, (2) /tmp/gnash-configure-warnings.$$, or (3) /tmp/gnash-configure-recommended.$$ files.

Affected products

Product	Affected versions	Fixed in
GNU gnash	= 0.8.8	No fix listed

References

bugs.debian.org
42416 third-party-advisory vendor-advisory
48466 third-party-advisory
DSA-2435 vendor-advisory
69533 vdb-entry
45102 vdb-entry

CVSS v2.0

3.3 Low

AV:L/AC:M/Au:N/C:N/I:P/A:P

Access Vector: Local
Access Complexity: Medium
Authentication: None
Confidentiality: None
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.34% (percentile 27.8)
CWE: CWE-59

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.