Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2719-1

Опубликовано: 18 окт. 2019
Источник: suse-cvrf

Описание

Security update for python-xdg

This update for python-xdg fixes the following issues:

Security issue fixed:

  • CVE-2014-1624: Fixed a TOCTOU race condition in get_runtime_dir(). (bsc#859835)

Список пакетов

SUSE Linux Enterprise Desktop 12 SP4
python-xdg-0.25-9.3.1
SUSE Linux Enterprise Server 12 SP4
python-xdg-0.25-9.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
python-xdg-0.25-9.3.1

Ссылки

Описание

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP4:python-xdg-0.25-9.3.1
SUSE Linux Enterprise Server 12 SP4:python-xdg-0.25-9.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-xdg-0.25-9.3.1
Ссылки