CVE-2014-1838: Improper Link Resolution Before File Access

The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...

CVE-2014-1839: Undefined Security Weakness

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

Updated python-logilab-common packages fix security vulnerabilities

Updated python-logilab-common packages fix security vulnerabilities about temporary file handling CVE-2014-1838 and CVE-2014-1839...

MGASA-2014-0118 Updated python-logilab-common packages fix security vulnerabilities

Updated python-logilab-common packages fix security vulnerabilities about temporary file handling CVE-2014-1838 and CVE-2014-1839...

PT-2014-4323

Name of the Vulnerable Software and Affected Versions logilab-common versions prior to 0.61.0 Description The Execute class in shellutils in logilab-common uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file. Recommendations For versions...

PT-2014-4322

Name of the Vulnerable Software and Affected Versions logilab-common versions prior to 0.61.0 Description The issue concerns the extract keys from pdf and fill pdf functions in pdf ext.py, allowing local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink...