Code injection

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. Th...

CVE-2016-8606

The REPL server --listen in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack...

CVE-2016-8606

The REPL server --listen in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack...

CVE-2016-8606

The REPL server --listen in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack...

CVE-2016-8606

GNU Guile 2.0.12’s REPL server --listen is vulnerable to an HTTP inter-protocol attack that can lead to remote arbitrary code execution when the REPL server is bound to a loopback or private network. Multiple external sources (Arch Linux ASA, Debian security tracker, and F5 advisory) confirm CVE-...

CVE-2016-8605

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. Th...

CVE-2016-8605

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. Th...

CVE-2016-8605

CVE-2016-8605 affects GNU Guile: the mkdir path temporarily changes the process umask to 0, allowing a race in multithreaded apps to create files with insecure permissions (e.g., 0777) in affected versions prior to Guile 2.0.13; remediation is upgrading to Guile 2.0.13 or later. Related CVE-2016-...

CVE-2016-8606

Removed by vendor...

MGASA-2016-0354 Updated guile packages fix security vulnerability

The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions CVE-2016-8605. GNU Guile, an...

Debian DLA-666-1 : guile-2.0 security update

Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that...

[SECURITY] [DLA 666-1] guile-2.0 security update

Package : guile-2.0 Version : 2.0.5+1-3+deb7u1 CVE ID : CVE-2016-8605 CVE-2016-8606 Debian Bug : 840555 840556 Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following...

DLA-666-1 guile-2.0 - security update

Bulletin has no description...

GNU Guile Remote Code Execution Vulnerability

GNU Guile is a set of programming languages developed by the GNU Project for creating flexible applications. A security vulnerability exists in GNU Guile that could be exploited by a remote attacker to execute arbitrary code with application privileges...

guile2 -- multiple vulnerabilities

Ludovic Courtès reports: The REPL server is vulnerable to the HTTP inter-protocol attack The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads...