CVE-2014-1624

2014-01-2800:55:04

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

3.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

EPSS

Percentile

5.1%

JSON

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

OSVersionArchitecturePackageVersionFilename
Debian12allpyxdg< 0.25-4pyxdg_0.25-4_all.deb
Debian11allpyxdg< 0.25-4pyxdg_0.25-4_all.deb
Debian999allpyxdg< 0.25-4pyxdg_0.25-4_all.deb
Debian13allpyxdg< 0.25-4pyxdg_0.25-4_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	pyxdg	< 0.25-4	pyxdg_0.25-4_all.deb
Debian	11	all	pyxdg	< 0.25-4	pyxdg_0.25-4_all.deb
Debian	999	all	pyxdg	< 0.25-4	pyxdg_0.25-4_all.deb
Debian	13	all	pyxdg	< 0.25-4	pyxdg_0.25-4_all.deb