3508 matches found
CVE-2001-1593
CVE-2001-1593 affects the a2ps package (versions 4.14 and earlier). The vulnerability is in the tempname_ensure function (lib/routines.h), used by the spy_user function, allowing local users to modify arbitrary files via a symlink attack on a temporary file. Impact is local file modification with...
SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 8974)
The OpenJDK Java Plugin IcedTea Web was released to fix a temporary file access problem. Changes : - Dialogs center on screen before becoming visible. - Support for u45 new manifest attributes Application-Name. - Custom applet permission policies panel in itweb-settings control panel. - Plugin...
CVE-2014-0135 rubygem-kafo: temporary file creation vulnerability when creating /tmp/default_values.yaml
Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for defaultvalues.yaml, which allows local users to obtain passwords and other sensitive information by reading the file...
Amazon Linux AMI : numpy (ALAS-2014-302)
f2py insecurely uses a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux A...
CVE-2014-1839
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...
CVE-2014-1839
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...
PYSEC-2014-83
The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...
PYSEC-2014-84
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...
CVE-2014-1839
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...
CVE-2014-1839
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...
Low: numpy
Issue Overview: f2py insecurely uses a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py. Affected Packages: numpy Issue Correction: Run yum update numpy or yum update --advisory ALAS-2014-302 to...
HawtJNI: predictable temporary file name leading to local arbitrary code execution
The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJN...
Updated python-logilab-common packages fix security vulnerabilities
Updated python-logilab-common packages fix security vulnerabilities about temporary file handling CVE-2014-1838 and CVE-2014-1839...
MGASA-2014-0118 Updated python-logilab-common packages fix security vulnerabilities
Updated python-logilab-common packages fix security vulnerabilities about temporary file handling CVE-2014-1838 and CVE-2014-1839...
HawtJNI: predictable temporary file name leading to local arbitrary code execution
The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJN...
DEBIAN-CVE-2013-6493
The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp...
PT-2014-4323 · Logilab +1 · Logilab-Common +1
Name of the Vulnerable Software and Affected Versions: logilab-common versions prior to 0.61.0 Description: The Execute class in shellutils in logilab-common uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file. Recommendations: For...
Fedora 19 : perl-Capture-Tiny-0.24-1.fc19 (2014-2261)
This release fixes CVE-2014-1875 -- insecure temporary file usage. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...
Updated python-numpy packages fix security vulnerabilities
f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859...
