PT-2012-4764 · Debian+1 · Devscripts+1

Jan Lieskovsky + 1 · Publicado 2012-10-01 · Atualizado 2024-06-15 · CVE-2012-3500

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions devscripts versions prior to 2.12.2 rpmdevtools versions prior to 8.3

Description The issue allows local users to modify arbitrary files via a symlink attack on the temporary standard output or standard error output file. This is related to the scripts/annotate-output.sh script in devscripts.

Recommendations For devscripts versions prior to 2.12.2, update to version 2.12.2 or later. For rpmdevtools versions prior to 8.3, update to version 8.3 or later.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2012-3500

DSA-2549-1

OPENSUSE-SU-2024:10372-1

OPENSUSE-SU-2024:11306-1

Produtos afetados

Devscripts

Rpmdevtools

Referências · 21

• http://ubuntu.com/usn/USN-1593-1 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2549 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086138.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2012-11/msg00000.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3500 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2013:123 · Aviso do Fabricante
• http://secunia.com/advisories/50600 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-3500 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3500 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/31/7 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087335.html · Aviso do Fabricante
• http://securityfocus.com/bid/55358 · Nota
• http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commit%3Bh=4d23a5e6c90f7a37b0972b30f5d31dce97a93eb0 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086159.html · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11306-1 · Aviso do Fabricante