CVE-2017-18240 The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access t...
MediumCVSS 5.5
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL (when the service is stopped).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| collectd | <= 5.7.2 | No fix listed |
| collectd | = 5.7.2-r1 | No fix listed |
References
- 103469 third-party-advisory vdb-entry
- bugs.gentoo.org issue-tracking vendor-advisory
- GLSA-201803-10 vendor-advisory
- Debian Security Tracker CVE-2017-18240 vendor-advisory