CVE-2019-13229

deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo function to write a log file as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content...

PT-2019-13195

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3 Description The issue allows an unprivileged user to create or overwrite files in arbitrary file system locations by preparing a symlink attack. This is due to the use of a fixed path /tmp/partclone.log in...

CVE-2019-13229: Improper Link Resolution Before File Access

deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo function to write a log file as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content...