DEBIAN-CVE-2014-1639

syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1639

syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1639

syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

Fedora 20 : prboom-plus-2.5.1.3-3.fc20 (2013-20940)

-------- prboom-plus-2.5.1.3-3 replaces mktemp with mkstemp to satisfy rpmlint Doom is a classic 3D shoot-em-up game. PrBoom+ is a Doom source port developed from the original PrBoom project by Andrey Budko. The target of the project is to extend the original port with features that are necessary...

Mandrake Linux Security Advisory : ghostscript (MDKSA-2000:074)

The ghostscript package uses mktemp instead of mkstemp to create temporary files. It also uses improper LDRUNPATH values, which causes it to search for libraries in the current directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

caml-light -- insecure use of temporary files

caml-light uses mktemp insecurely, and also does unsafe things in /tmp during make install...

Fedora 15 : foomatic-4.0.8-3.fc15 (2011-11196)

This package fixes CVE-2011-2924 by using mktemp when creating a debug log file in debug mode. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

Fedora 14 : foomatic-4.0.8-3.fc14 (2011-11205)

This package fixes CVE-2011-2924 by using mktemp when creating a debug log file in debug mode. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

Fedora 16 : foomatic-4.0.8-4.fc16 (2011-11118)

This package fixes CVE-2011-2924 by using mktemp when creating a debug log file in debug mode. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

DEBIAN-CVE-2009-5082

The 1 configure and 2 config.guess scripts in GNU troff aka groff 1.20.1 on Openwall GNU//Linux aka Owl improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2009-5082

The 1 configure and 2 config.guess scripts in GNU troff aka groff 1.20.1 on Openwall GNU//Linux aka Owl improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file...

Fedora 14 : xorg-x11-server-1.9.0-9.fc14 (2010-14754)

Refuse to believe tiny or negative sizes from PanelID. 632805 - Call mktemp correctly 632879 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

[Backports-security-announce] Security Update for devscripts

Adam D. Barratt uploaded new packages for devscripts which fixed the following security problems: Debian BTS 507482 When copying files from a remote host for signing, the temporary directory created was named based on the process ID rather than using mktemp. Debian BTS 508111 A call to mktemp use...

[Backports-security-announce] Security Update for devscripts

Adam D. Barratt uploaded new packages for devscripts which fixed the following security problems: Debian BTS 507482 When copying files from a remote host for signing, the temporary directory created was named based on the process ID rather than using mktemp. Debian BTS 508111 A call to mktemp use...

[Backports-security-announce] Security Update for devscripts

Adam D. Barratt uploaded new packages for devscripts which fixed the following security problems: Debian BTS 507482 When copying files from a remote host for signing, the temporary directory created was named based on the process ID rather than using mktemp. Debian BTS 508111 A call to mktemp use...

CVE-2006-5298

The muttadvmktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safefopen function cal...

Mandrake Linux Security Advisory : lm_sensors (MDKSA-2005:149)

Javier Fernandez-Sanguino Pena discovered that the pwmconfig script in the lmsensors package created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with full root privileges because pwmconfig is typically executed by root. The updat...

Mandrake Linux Security Advisory : gzip (MDKSA-2003:068)

A vulnerability exists in znew, a script included with gzip, that would create temporary files without taking precautions to avoid a symlink attack. Patches have been applied to make use of mktemp to generate unique filenames, and properly make use of noclobber in the script. Likewise, a fix for...

Проблема символьных линков в lmail (symbolic links)

Используется mktemp...

lmail local root exploit

lmail is vulnerable to an insecure mktemp race which allows a user to overwrite or create a files. Offending code lmail.c: define MAILTMPFILE "/tmp/rmXXXXXX" ... static char tempfname = MAILTMPFILE; ... if fseekstdin, 0L, 0 != 0 mailfile = fopenmktemptempfname, "w+"; ... Patch: s/mktemp/mkstemp/g...