CVE-2012-0808 as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.
LowCVSS 3.6
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/as31(Debian:12) | < 2.3.1-5 | 2.3.1-5 |
| debian/as31(Debian:13) | < 2.3.1-5 | 2.3.1-5 |
| debian/as31(Debian:14) | < 2.3.1-5 | 2.3.1-5 |
| bdale garbee as31 | = 2.3.1-4 | No fix listed |
References
- Debian Security Tracker CVE-2012-0808 vendor-advisory
- bugs.debian.org
- [oss-security] 20120124 Re: CVE requests: Suhosin extension / as31 mailing-list
- [oss-security] 20120124 CVE requests: Suhosin extension / as31 mailing-list
- [oss-security] 20120705 Three CVE requests: at-spi2-atk, as31, naxsi mailing-list
- [oss-security] 20120706 Re: Three CVE requests: at-spi2-atk, as31, naxsi mailing-list
- [oss-security] 20120831 Re: Three CVE requests: at-spi2-atk, as31, naxsi mailing-list
- bugs.debian.org issue-tracking