CVE-2011-4617 Virtualenv Allows Symlink Attack on /tmp/
LowCVSS 1.2
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi virtualenv(PyPI) | < 1.5 | 1.5 |
| pypi virtualenv(PyPI) | = 0.8 | No fix listed |
| pypi virtualenv(PyPI) | = 0.8.1 | No fix listed |
| pypi virtualenv(PyPI) | = 0.8.2 | No fix listed |
| pypi virtualenv(PyPI) | = 0.8.3 | No fix listed |
| pypi virtualenv(PyPI) | = 0.8.4 | No fix listed |
| pypi virtualenv(PyPI) | = 0.9 | No fix listed |
| pypi virtualenv(PyPI) | = 0.9.1 | No fix listed |
| pypi virtualenv(PyPI) | = 0.9.2 | No fix listed |
| pypi virtualenv(PyPI) | = 1.0 | No fix listed |
| pypi virtualenv(PyPI) | = 1.1 | No fix listed |
| pypi virtualenv(PyPI) | = 1.2 | No fix listed |
| pypi virtualenv(PyPI) | = 1.3 | No fix listed |
| pypi virtualenv(PyPI) | = 1.3.1 | No fix listed |
| pypi virtualenv(PyPI) | = 1.3.2 | No fix listed |
| pypi virtualenv(PyPI) | = 1.3.3 | No fix listed |
| pypi virtualenv(PyPI) | = 1.3.4 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.1 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.2 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.3 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.4 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.5 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.6 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.7 | No fix listed |
Show 33 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi virtualenv(PyPI) | = 1.4.8 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4.9 | No fix listed |
| pypi virtualenv(PyPI) | = 1.4rc1 | No fix listed |
| debian/python-virtualenv(Debian:12) | < 1.6-1 | 1.6-1 |
| debian/python-virtualenv(Debian:13) | < 1.6-1 | 1.6-1 |
| debian/python-virtualenv(Debian:14) | < 1.6-1 | 1.6-1 |
| python virtualenv | <= 1.4.9 | No fix listed |
| python virtualenv | = 0.8 | No fix listed |
| python virtualenv | = 0.8.1 | No fix listed |
| python virtualenv | = 0.8.2 | No fix listed |
| python virtualenv | = 0.8.3 | No fix listed |
| python virtualenv | = 0.8.4 | No fix listed |
| python virtualenv | = 0.9 | No fix listed |
| python virtualenv | = 0.9.1 | No fix listed |
| python virtualenv | = 0.9.2 | No fix listed |
| python virtualenv | = 1.0 | No fix listed |
| python virtualenv | = 1.1 | No fix listed |
| python virtualenv | = 1.1.1 | No fix listed |
| python virtualenv | = 1.2 | No fix listed |
| python virtualenv | = 1.3 | No fix listed |
| python virtualenv | = 1.3.1 | No fix listed |
| python virtualenv | = 1.3.2 | No fix listed |
| python virtualenv | = 1.3.3 | No fix listed |
| python virtualenv | = 1.3.4 | No fix listed |
| python virtualenv | = 1.4 | No fix listed |
| python virtualenv | = 1.4.1 | No fix listed |
| python virtualenv | = 1.4.2 | No fix listed |
| python virtualenv | = 1.4.3 | No fix listed |
| python virtualenv | = 1.4.4 | No fix listed |
| python virtualenv | = 1.4.5 | No fix listed |
| python virtualenv | = 1.4.6 | No fix listed |
| python virtualenv | = 1.4.7 | No fix listed |
| python virtualenv | = 1.4.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bitbucket.org
- github.com
- github.com product
- web.archive.org
- FEDORA-2011-17289 vendor-advisory
- FEDORA-2011-17341 vendor-advisory
- [oss-security] 20111219 CVE id request: python-virtualenv mailing-list
- [oss-security] 20111219 Re: CVE id request: python-virtualenv mailing-list
- [oss-security] 20111219 Re: CVE id request: python-virtualenv mailing-list
- 47240 third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2011-4617 vendor-advisory
- bugs.debian.org issue-tracking