CVE-2014-1859 Numpy arbitrary file write via symlink attack
MediumCVSS 5.5
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi numpy(PyPI) | < 1.8.1 | 1.8.1 |
| pypi numpy(PyPI) | = 0.9.6 | No fix listed |
| pypi numpy(PyPI) | = 0.9.8 | No fix listed |
| pypi numpy(PyPI) | = 1.0 | No fix listed |
| pypi numpy(PyPI) | = 1.0.3 | No fix listed |
| pypi numpy(PyPI) | = 1.0.4 | No fix listed |
| pypi numpy(PyPI) | = 1.0b1 | No fix listed |
| pypi numpy(PyPI) | = 1.0b4 | No fix listed |
| pypi numpy(PyPI) | = 1.0b5 | No fix listed |
| pypi numpy(PyPI) | = 1.0rc1 | No fix listed |
| pypi numpy(PyPI) | = 1.0rc2 | No fix listed |
| pypi numpy(PyPI) | = 1.0rc3 | No fix listed |
| pypi numpy(PyPI) | = 1.1.1 | No fix listed |
| pypi numpy(PyPI) | = 1.2.0 | No fix listed |
| pypi numpy(PyPI) | = 1.2.1 | No fix listed |
| pypi numpy(PyPI) | = 1.3.0 | No fix listed |
| pypi numpy(PyPI) | = 1.4.0 | No fix listed |
| pypi numpy(PyPI) | = 1.4.1 | No fix listed |
| pypi numpy(PyPI) | = 1.5.0 | No fix listed |
| pypi numpy(PyPI) | = 1.5.1 | No fix listed |
| pypi numpy(PyPI) | = 1.6.0 | No fix listed |
| pypi numpy(PyPI) | = 1.6.1 | No fix listed |
| pypi numpy(PyPI) | = 1.6.2 | No fix listed |
| pypi numpy(PyPI) | = 1.7.0 | No fix listed |
| pypi numpy(PyPI) | = 1.7.1 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi numpy(PyPI) | = 1.7.2 | No fix listed |
| pypi numpy(PyPI) | = 1.8.0 | No fix listed |
| debian/python-numpy(Debian:10) | < 1:1.8.1~rc1-1 | 1:1.8.1~rc1-1 |
| numpy | <= 1.8.0 | No fix listed |
| numpy | = 1.8.1-rc1 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- bugs.debian.org issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch
- numpy-cve20141859-symlink(91317) issue-tracking third-party-advisory vdb-entry
- github.com vendor-advisory
- github.com product
- github.com patch third-party-advisory
- github.com
- web.archive.org
- FEDORA-2014-2289 issue-tracking third-party-advisory vendor-advisory
- FEDORA-2014-2387 issue-tracking third-party-advisory vendor-advisory
- [oss-security] 20140207 Re: CVE request: f2py insecure temporary file use issue-tracking mailing-list patch third-party-advisory
- 65440 third-party-advisory vdb-entry