DLA-2095-1 storebackup - security update
Published
Unknown
Product
debian/storebackup vulnerabilities
6 published CVES affecting debian/storebackup, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 2
- Unscored
- 2
- CISA KEV
- 0
Latest debian/storebackup CVEs
Newest publication first
-
-
HighCVSS 8.1 EPSS 2.9%
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manual...
-
DSA-1022-1 storebackup - several
PublishedUnknown -
MediumCVSS 4.6 EPSS 0.38%
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.
-
LowCVSS 2.1 EPSS 0.36%
StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.
-
LowCVSS 2.1 EPSS 0.36%
StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.