CVE-2015-4156 GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
LowCVSS 3.6
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/parallel(Debian:12) | < 20161222-1 | 20161222-1 |
| debian/parallel(Debian:13) | < 20161222-1 | 20161222-1 |
| debian/parallel(Debian:14) | < 20161222-1 | 20161222-1 |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| GNU parallel | <= 20150322 | No fix listed |
References
- Debian Security Tracker CVE-2015-4156 vendor-advisory
- [parallel] 20150423 GNU Parallel Security Advisory: GNU Parallel can be tricked into overwriting a file mailing-list vendor-advisory
- [parallel] 20150522 GNU Parallel 20150522 ('Nepal') released [stable] mailing-list vendor-advisory
- openSUSE-SU-2015:0968 vendor-advisory
- 74961 vdb-entry
- bugs.debian.org issue-tracking