CVE-2014-2524

Опубликовано: 20 авг. 2014

Источник: nvd

CVSS2: 3.3

EPSS Низкий

Описание

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

Ссылки

http://advisories.mageia.org/MGASA-2014-0319.html
Third Party Advisory
http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html
Patch
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html
Third Party Advisory
http://seclists.org/oss-sec/2014/q1/579
Mailing List
Third Party Advisory
http://seclists.org/oss-sec/2014/q1/587
Mailing List
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:154
Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2015:132
Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1077023
Issue Tracking
https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135686.html
Third Party Advisory
http://advisories.mageia.org/MGASA-2014-0319.html
Third Party Advisory
http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html
Patch
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html
Third Party Advisory
http://seclists.org/oss-sec/2014/q1/579
Mailing List
Third Party Advisory
http://seclists.org/oss-sec/2014/q1/587
Mailing List
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:154
Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2015:132
Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1077023
Issue Tracking
https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135686.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*

cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:gnu:readline:*:*:*:*:*:*:*:*

Версия до 6.3 (включая)

cpe:2.3:a:gnu:readline:2.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:2.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:4.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:4.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:4.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:4.2:a:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:4.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:5.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:5.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:5.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:6.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:6.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:readline:6.2:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*

EPSS

Процентиль: 37%

0.00157

Низкий

3.3 Low

CVSS2

Дефекты

CWE-59

Связанные уязвимости

CVE-2014-2524

ubuntu

больше 11 лет назад

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

CVE-2014-2524

redhat

почти 12 лет назад

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

CVE-2014-2524

debian

больше 11 лет назад

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 a ...

GHSA-hq65-wq6g-7mcc

github

больше 3 лет назад

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

EPSS

Процентиль: 37%

0.00157

Низкий

3.3 Low

CVSS2

Дефекты

CWE-59