CVE-2012-2093 src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.
LowCVSS 3.3
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/gajim(Debian:12) | < 0.15-1.1 | 0.15-1.1 |
| debian/gajim(Debian:13) | < 0.15-1.1 | 0.15-1.1 |
| debian/gajim(Debian:14) | < 0.15-1.1 | 0.15-1.1 |
| gajim | = 0.15 | No fix listed |
References
- Debian Security Tracker CVE-2012-2093 vendor-advisory
- hg.gajim.org
- FEDORA-2012-6161 vendor-advisory
- FEDORA-2012-6001 vendor-advisory
- FEDORA-2012-6061 vendor-advisory
- 48695 third-party-advisory vendor-advisory
- 48794 third-party-advisory
- GLSA-201208-04 vendor-advisory
- [oss-security] 20120410 RE: gajim insecure file creation when using latex mailing-list
- [oss-security] 20120410 gajim insecure file creation when using latex mailing-list
- 53017 vdb-entry
- gajim-gettmpfilename-symlink(74869) vdb-entry
- trac.gajim.org
- bugs.debian.org issue-tracking