CVE-2015-4155 GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
LowCVSS 3.6
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/parallel(Debian:12) | < 20161222-1 | 20161222-1 |
| debian/parallel(Debian:13) | < 20161222-1 | 20161222-1 |
| debian/parallel(Debian:14) | < 20161222-1 | 20161222-1 |
| GNU parallel | <= 20150322 | No fix listed |
References
- Debian Security Tracker CVE-2015-4155 vendor-advisory
- [parallel] 20150423 GNU Parallel Security Advisory: GNU Parallel can be tricked into overwriting a file mailing-list vendor-advisory
- [parallel] 20150522 GNU Parallel 20150522 ('Nepal') released [stable] mailing-list vendor-advisory
- 74962 vdb-entry
- bugs.debian.org issue-tracking