PT-2014-4322 · Logilab+1 · Logilab-Common+1

Jakub Wilk · CVE-2014-1838 · Publicado 2014-02-27 · Atualizado 2024-07-12

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions logilab-common versions prior to 0.61.0

Description The issue concerns the extract keys from pdf and fill pdf functions in pdf ext.py, allowing local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.

Recommendations For versions prior to 0.61.0, update to version 0.61.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the extract keys from pdf and fill pdf functions in pdf ext.py to minimize the risk of exploitation.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2014-1838

GHSA-RR52-WG7F-8875

MGASA-2014-0118

OPENSUSE-SU-2024:10400-1

OPENSUSE-SU-2024:11235-1

OPENSUSE-SU-2024:14145-1

PYSEC-2014-83

SUSE-SU-2014_0301-1

Produtos afetados

Suse

Logilab-Common

Referências · 31

• https://github.com/pypa/advisory-database/tree/main/vulns/logilab-common/PYSEC-2014-83.yaml · Nota
• https://osv.dev/vulnerability/MGASA-2014-0118 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:14145-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00085.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1839 · Nota de Segurança
• https://bugs.gentoo.org/show_bug.cgi?id=499872 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1838 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-1838 · Nota de Segurança
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://osv.dev/vulnerability/GHSA-rr52-wg7f-8875 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1060304 · Nota
• http://download.novell.com/patch/finder/?keywords=a47a40734ab35938287f3f5665ecd80f · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2014-February/000737.html · Nota
• https://suse.com/security/cve/CVE-2014-1838 · Nota
• http://comments.gmane.org/gmane.comp.security.oss.general/11986 · Nota