bash: Insecure temporary file use in aliasconv.sh, aliasconv.bash, cshtobash (symlink attack)

bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb.? temporary file, related to the 1 aliasconv.sh, 2 aliasconv.bash, and 3 cshtobash scripts...

CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

DEBIAN-CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

UBUNTU-CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

Arbitrary file deletion

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

CVE-2011-0702

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

DEBIAN-CVE-2011-0702

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

CVE-2011-0702

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

CVE-2011-1031

The fehuniquefilename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh temporary file, a different vulnerability than CVE-2011-0702...

Arbitrary file deletion

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

CVE-2011-1031

The provided documents confirm a local privilege/filenaming issue in feh (CVE-2011-1031) affecting feh 1.11.2 and earlier, due to a symlink race in feh_unique_filename that can let a local user create/overwrite files under /tmp/feh_. Exploitation is local and does not require authentication. The ...

CVE-2011-0702

CVE-2011-0702 affects feh before 1.11.2, where feh_unique_filename in utils.c can be exploited by local users via a symlink attack on a /tmp/feh_ temporary file to overwrite arbitrary files. Public references describe this as a local vulnerability with potential for file overwrite; remediation ob...

CVE-2011-0702

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

CVE-2011-0702

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

CVE-2011-0543

Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack...

CVE-2011-0541

fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack...

CVE-2011-0017

The openlog function in log.c in Exim 4.72 and earlier does not check the return value from 1 setuid or 2 setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack...

DEBIAN-CVE-2011-0017

The openlog function in log.c in Exim 4.72 and earlier does not check the return value from 1 setuid or 2 setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack...