PT-2014-2739

Name of the Vulnerable Software and Affected Versions Node Packaged Modules npm versions prior to 1.3.3 Description The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives. This can potential...

PT-2014-2802

Name of the Vulnerable Software and Affected Versions Xpdf versions prior to 0.24.4 Poppler versions prior to 0.24.4 Description The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names, specifically when the openTempFile function in...

PT-2014-4396

Name of the Vulnerable Software and Affected Versions AndExplorer versions prior to 20140403 AndExplorerPro versions prior to 20140405 Description A directory traversal issue exists in the affected applications, allowing attackers to overwrite or create arbitrary files through unspecified vectors...

CVE-2014-1932

The 1 loaddjpeg function in JpegImagePlugin.py, 2 Ghostscript function in EpsImagePlugin.py, 3 load function in IptcImagePlugin.py, and 4 copy function in Image.py in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users...

CVE-2014-1932: Improper Link Resolution Before File Access

The 1 loaddjpeg function in JpegImagePlugin.py, 2 Ghostscript function in EpsImagePlugin.py, 3 load function in IptcImagePlugin.py, and 4 copy function in Image.py in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users...

CVE-2014-1969: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename...

PT-2014-4371

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.3.1 Python Image Library PIL versions 1.1.7 and earlier Description The issue concerns the improper creation of temporary files by certain functions in Python Image Library PIL and Pillow, allowing local users to...

PT-2014-4393

Name of the Vulnerable Software and Affected Versions ES File Explorer File Manager version 3.0.3 and earlier Description A directory traversal issue in the ES File Explorer File Manager application allows remote attackers to overwrite or create arbitrary files. Recommendations For versions prior...

CVE-2014-1838

The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...

CVE-2014-1838: Improper Link Resolution Before File Access

The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...

CVE-2014-2059

Directory traversal vulnerability in the CLI job creation hudson/cli/CreateJobCommand.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name...

PT-2014-4459

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.551 Jenkins LTS versions prior to 1.532.2 Description A directory traversal issue exists in the CLI job creation, allowing remote authenticated users to overwrite arbitrary files via the job name. This is due to a...

CVE-2013-4420

Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. dot dot in a crafted tar file...

CVE-2012-1088

iproute2 before 3.3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file used by 1 configure or 2 examples/dhcp-client-script...

CVE-2011-1837: Undefined Security Weakness

The lock-counter implementation in utils/mount.ecryptfsprivate.c in ecryptfs-utils before 90 allows local users to overwrite arbitrary files via unspecified vectors...

CVE-2012-1088: Improper Link Resolution Before File Access

iproute2 before 3.3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file used by 1 configure or 2 examples/dhcp-client-script...

CVE-2010-4226: Improper Link Resolution Before File Access

cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive...

DEBIAN-CVE-2014-1640

axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

PT-2014-4263

Name of the Vulnerable Software and Affected Versions python-xdg version 0.25 Description A race condition exists in the xdg.BaseDirectory.get runtime dir function, allowing local users to overwrite arbitrary files. This is achieved by pre-creating a file to point to a victim-owned location, then...

CVE-2014-1640: Improper Link Resolution Before File Access

axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...