CVE-2011-1500 PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory, which allows local users to obtain Pandora credentials by....
LowCVSS 2.1
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory, which allows local users to obtain Pandora credentials by reading this file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kevinmehall pithos | = 0.3.7 | No fix listed |
| debian/pithos(Debian:12) | < 0.3.8-1 | 0.3.8-1 |
| debian/pithos(Debian:13) | < 0.3.8-1 | 0.3.8-1 |
| debian/pithos(Debian:14) | < 0.3.8-1 | 0.3.8-1 |
References
- [oss-security] 20110408 CVE request for pithos information disclosure mailing-list
- [oss-security] 20110408 Re: CVE request for pithos information disclosure mailing-list
- 44059 third-party-advisory vendor-advisory
- 47300 vdb-entry
- bugs.launchpad.net
- pithos-pithos-info-disclosure(66661) vdb-entry
- Debian Security Tracker CVE-2011-1500 vendor-advisory