CVE-2014-1639 syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows l...
LowCVSS 3.3
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/syncevolution(Debian:12) | < 1.3.99.7-1 | 1.3.99.7-1 |
| debian/syncevolution(Debian:14) | < 1.3.99.7-1 | 1.3.99.7-1 |
| debian/syncevolution(Debian:14) | = 0.9+ds1-2 | No fix listed |
| debian/syncevolution(Debian:14) | = 0.9.1+ds1-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.0+ds1~a1-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.0+ds1~a1-2 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.0+ds1~beta2a-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.0+ds1~beta2a-2 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1+ds1-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1+ds1-2 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1+ds1-3 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1+ds1-4 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1+ds1-5 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1.99.3+ds1-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1.99.5a-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.1.99.5a-2 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.2.1-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.2.2-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.2.99.1-1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.2.99.1-1.1 | No fix listed |
| debian/syncevolution(Debian:14) | = 1.3.2-1 | No fix listed |
| debian/syncevolution | <= 1.3.99.6 | No fix listed |
References
- Debian Security Tracker CVE-2014-1639 vendor-advisory
- bugs.debian.org vendor-advisory
- [oss-security] 20140122 Getting tempfile/mktemp wrong mailing-list
- [oss-security] 20140122 Re: Getting tempfile/mktemp wrong mailing-list
- 102380 vdb-entry
- 65098 vdb-entry
- syncevolution-cve20141639-symlink(90662) vdb-entry
- bugs.debian.org issue-tracking