Описание
Jakub Wilk found that a2ps, a tool to convert text and other types of files to PostScript, insecurely used a temporary file in spy_user(). A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running a2ps.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1:4.14-1.2 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was not-affected [1:4.14-1.2]] |
| lucid | ignored | end of life |
| precise | released | 1:4.14-1.1+deb7u1build0.12.04.1 |
| trusty | not-affected | 1:4.14-1.2 |
| trusty/esm | DNE | trusty was not-affected [1:4.14-1.2] |
| upstream | needs-triage | |
| utopic | not-affected | 1:4.14-1.2 |
| vivid | not-affected | 1:4.14-1.2 |
Показывать по
Ссылки на источники
EPSS
2.1 Low
CVSS2
Связанные уязвимости
The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlie ...
The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
EPSS
2.1 Low
CVSS2