CVE-2014-1858 Arbitrary file write in NumPy
MediumCVSS 5.5
EPSS 0.45%
- Published
- Updated
- Exploit status
- No public exploit known
Description
init.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi numpy(PyPI) | < 1.8.1 | 1.8.1 |
| pypi numpy(PyPI) | = 0.9.6 | No fix listed |
| pypi numpy(PyPI) | = 0.9.8 | No fix listed |
| pypi numpy(PyPI) | = 1.0 | No fix listed |
| pypi numpy(PyPI) | = 1.0.3 | No fix listed |
| pypi numpy(PyPI) | = 1.0.4 | No fix listed |
| pypi numpy(PyPI) | = 1.0b1 | No fix listed |
| pypi numpy(PyPI) | = 1.0b4 | No fix listed |
| pypi numpy(PyPI) | = 1.0b5 | No fix listed |
| pypi numpy(PyPI) | = 1.0rc1 | No fix listed |
| pypi numpy(PyPI) | = 1.0rc2 | No fix listed |
| pypi numpy(PyPI) | = 1.0rc3 | No fix listed |
| pypi numpy(PyPI) | = 1.1.1 | No fix listed |
| pypi numpy(PyPI) | = 1.2.0 | No fix listed |
| pypi numpy(PyPI) | = 1.2.1 | No fix listed |
| pypi numpy(PyPI) | = 1.3.0 | No fix listed |
| pypi numpy(PyPI) | = 1.4.0 | No fix listed |
| pypi numpy(PyPI) | = 1.4.1 | No fix listed |
| pypi numpy(PyPI) | = 1.5.0 | No fix listed |
| pypi numpy(PyPI) | = 1.5.1 | No fix listed |
| pypi numpy(PyPI) | = 1.6.0 | No fix listed |
| pypi numpy(PyPI) | = 1.6.1 | No fix listed |
| pypi numpy(PyPI) | = 1.6.2 | No fix listed |
| pypi numpy(PyPI) | = 1.7.0 | No fix listed |
| pypi numpy(PyPI) | = 1.7.1 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi numpy(PyPI) | = 1.7.2 | No fix listed |
| pypi numpy(PyPI) | = 1.8.0 | No fix listed |
| numpy | < 1.8.1 | 1.8.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- bugs.debian.org mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- numpy-cve20141858-symlink(91318) third-party-advisory vdb-entry
- github.com vendor-advisory
- github.com product
- github.com third-party-advisory
- github.com
- FEDORA-2014-2289 third-party-advisory vendor-advisory
- FEDORA-2014-2387 third-party-advisory vendor-advisory
- [oss-security] 20140207 Re: CVE request: f2py insecure temporary file use mailing-list third-party-advisory
- 65441 third-party-advisory vdb-entry