{"href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-4803", "history": [], "references": ["http://www.securityfocus.com/bid/15050", "http://www.debian.org/security/2005/dsa-857", "http://www.mandriva.com/security/advisories?name=MDKSA-2005:188", "http://www.ubuntulinux.org/support/documentation/usn/usn-208-1"], "lastseen": "2016-09-03T06:17:03", "bulletinFamily": "NVD", "title": "CVE-2005-4803", "cpe": ["cpe:/a:graphviz:graphviz:1.5.2", "cpe:/a:graphviz:graphviz:1.7.5.3", "cpe:/a:graphviz:graphviz:1.10_2003-09-15_0415_1", "cpe:/a:graphviz:graphviz:2.2", "cpe:/a:graphviz:graphviz:1.10_2003-09-15_0415_2", "cpe:/a:graphviz:graphviz:1.7.5.7", "cpe:/a:graphviz:graphviz:1.7.5.6", "cpe:/a:graphviz:graphviz:1.8.5.2", "cpe:/a:graphviz:graphviz:1.5.1", "cpe:/a:graphviz:graphviz:1.7.16.1", "cpe:/a:graphviz:graphviz:1.14.1", "cpe:/a:graphviz:graphviz:1.7.5.1", "cpe:/a:graphviz:graphviz:1.8.9.1", "cpe:/a:graphviz:graphviz:1.8.5.1", "cpe:/a:graphviz:graphviz:1.12.1", "cpe:/a:graphviz:graphviz:1.12.3", "cpe:/a:graphviz:graphviz:1.12.2", "cpe:/a:graphviz:graphviz:1.7.5_0.1", "cpe:/a:graphviz:graphviz:1.7.5.5", "cpe:/a:graphviz:graphviz:1.7.5.2", "cpe:/a:graphviz:graphviz:1.7.5.4", "cpe:/a:graphviz:graphviz:1.7.5_0.3", "cpe:/a:graphviz:graphviz:1.7.16.2", "cpe:/a:graphviz:graphviz:1.7.5_0.2", "cpe:/a:graphviz:graphviz:1.16.1", "cpe:/a:graphviz:graphviz:1.5.3"], "viewCount": 0, "id": "CVE-2005-4803", "hash": "dd3633d58fffab11cb1d6cd36755b80550481ced2fbc355f1a5c30063ec87570", "description": "graphviz before 2.2.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files. NOTE: this issue was originally associated with a different CVE identifier, CVE-2005-2965, which had been used for multiple different issues. This is the correct identifier.", "edition": 1, "assessment": {"name": "", "href": "", "system": ""}, "cvelist": ["CVE-2005-4803"], "scanner": [], "modified": "2008-09-05T16:57:52", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "objectVersion": "1.2", "reporter": "NVD", "type": "cve", "published": "2005-12-31T00:00:00", "enchantments": {"vulnersScore": 2.1}}

{"result": {"nessus": [{"id": "DEBIAN_DSA-857.NASL", "type": "nessus", "title": "Debian DSA-857-1 : graphviz - insecure temporary file", "description": "Javier Fernandez-Sanguino Pena discovered insecure temporary file creation in graphviz, a rich set of graph drawing tools, that can be exploited to overwrite arbitrary files by a local attacker.", "published": "2005-10-11T00:00:00", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=19965", "cvelist": ["CVE-2005-4803"], "lastseen": "2017-10-29T13:39:47"}, {"id": "MANDRAKE_MDKSA-2005-188.NASL", "type": "nessus", "title": "Mandrake Linux Security Advisory : graphviz (MDKSA-2005:188)", "description": "Javier Fernández-Sanguino Peña discovered insecure temporary file creation in graphviz, a rich set of graph drawing tools, that can be exploited to overwrite arbitrary files by a local attacker.\n\nThe updated packages have been patched to address this issue.", "published": "2006-01-15T00:00:00", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=20433", "cvelist": ["CVE-2005-4803"], "lastseen": "2017-10-29T13:34:22"}, {"id": "UBUNTU_USN-208-1.NASL", "type": "nessus", "title": "Ubuntu 5.04 : graphviz vulnerability (USN-208-1)", "description": "Javier Fernandez-Sanguino Pena discovered that the 'dotty' tool created and used temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running dotty.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2006-01-15T00:00:00", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=20625", "cvelist": ["CVE-2005-4803"], "lastseen": "2017-10-29T13:35:46"}], "debian": [{"id": "DSA-857", "type": "debian", "title": "graphviz -- insecure temporary file", "description": "Javier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered insecure temporary file creation in graphviz, a rich set of graph drawing tools, that can be exploited to overwrite arbitrary files by a local attacker.\n\nFor the old stable distribution (woody) this problem probably persists but the package is non-free.\n\nFor the stable distribution (sarge) this problem has been fixed in version 2.2.1-1sarge1.\n\nFor the unstable distribution (sid) this problem has been fixed in version 2.2.1-1sarge1.\n\nWe recommend that you upgrade your graphviz package.", "published": "2005-10-10T00:00:00", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-857", "cvelist": ["CVE-2005-4803"], "lastseen": "2017-10-05T13:11:36"}], "osvdb": [{"id": "OSVDB:19891", "type": "osvdb", "title": "Graphviz dotty.lefty Symlink Arbitrary File Overwrite", "description": "# No description provided by the source\n\n## References:\n[Secunia Advisory ID:17121](https://secuniaresearch.flexerasoftware.com/advisories/17121/)\n[Secunia Advisory ID:17207](https://secuniaresearch.flexerasoftware.com/advisories/17207/)\n[Secunia Advisory ID:17125](https://secuniaresearch.flexerasoftware.com/advisories/17125/)\nOther Advisory URL: http://www.debian.org/security/2005/dsa-857\nOther Advisory URL: http://www.ubuntu.com/usn/usn-208-1\n[CVE-2005-4803](https://vulners.com/cve/CVE-2005-4803)\n[CVE-2005-2965](https://vulners.com/cve/CVE-2005-2965)\nBugtraq ID: 15050\n", "published": "2005-10-10T11:22:26", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:19891", "cvelist": ["CVE-2005-4803", "CVE-2005-2965"], "lastseen": "2017-04-28T13:20:16"}], "ubuntu": [{"id": "USN-208-1", "type": "ubuntu", "title": "graphviz vulnerability", "description": "Javier Fern\ufffdndez-Sanguino Pe\ufffda discovered that the \u201cdotty\u201d tool created and used temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running dotty.", "published": "2005-10-17T00:00:00", "cvss": {"score": 3.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/208-1/", "cvelist": ["CVE-2005-4803", "CVE-2005-2965"], "lastseen": "2018-03-29T18:20:34"}]}}