Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2719-2

Опубликовано: 12 нояб. 2019
Источник: suse-cvrf

Описание

Security update for python-xdg

This update for python-xdg fixes the following issues:

Security issue fixed:

  • CVE-2014-1624: Fixed a TOCTOU race condition in get_runtime_dir(). (bsc#859835)

Список пакетов

SUSE Linux Enterprise Server 12 SP5
python-xdg-0.25-9.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
python-xdg-0.25-9.3.1

Ссылки

Описание

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:python-xdg-0.25-9.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-xdg-0.25-9.3.1
Ссылки