CVE-2011-3154

CVE-2011-3154 affects Ubuntu Update Manager (DistUpgrade/DistUpgradeViewKDE.py) where temporary files are created insecurely, enabling a local user to read the attacker’s XAUTHORITY file via a symlink attack. The issue is documented in CVE-2011-3154 with affected versions prior to specific update...

CVE-2011-3154: Improper Link Resolution Before File Access

DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file...

CVE-2012-0948: Undefined Security Weakness

DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for 1 apt-clonesystemstate.tar.gz and 2 systemstate.tar.gz, which allows local users to obtain repository credentials...