CVE-2014-1838 Improper Link Resolution Before File Access in logilab-commons
MediumCVSS 4.4
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi logilab-common(PyPI) | < 0.61.0 | 0.61.0 |
| pypi logilab-common(PyPI) | = 0.28.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.38.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.38.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.39.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.43.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.44.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.46.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.46.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.47.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.48.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.49.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.50.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.50.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.50.2 | No fix listed |
| pypi logilab-common(PyPI) | = 0.50.3 | No fix listed |
| pypi logilab-common(PyPI) | = 0.51.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.51.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.52.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.52.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.53.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.54.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.55.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.55.2 | No fix listed |
| pypi logilab-common(PyPI) | = 0.56.0 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi logilab-common(PyPI) | = 0.56.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.56.2 | No fix listed |
| pypi logilab-common(PyPI) | = 0.57.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.57.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.58.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.58.3 | No fix listed |
| pypi logilab-common(PyPI) | = 0.59.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.59.1 | No fix listed |
| pypi logilab-common(PyPI) | = 0.60.0 | No fix listed |
| pypi logilab-common(PyPI) | = 0.60.1 | No fix listed |
| pypi logilab-common(PyPI) | < 0.60.1 | 0.60.1 |
| debian/logilab-common(Debian:12) | < 0.61.0-1 | 0.61.0-1 |
| debian/logilab-common(Debian:13) | < 0.61.0-1 | 0.61.0-1 |
| debian/logilab-common(Debian:14) | < 0.61.0-1 | 0.61.0-1 |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| logilab-common | <= 0.60.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.debian.org
- github.com vendor-advisory
- github.com
- [oss-security] 20140131 CVE request: temp file issues in python's logilab-common module mailing-list
- openSUSE-SU-2014:0306 vendor-advisory
- www.logilab.org
- 57209 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2014-1838 vendor-advisory
- bugs.debian.org issue-tracking