PT-2008-5149 · Lxde · Gpicview

Published 2008-09-03 · Updated 2008-09-17 · CVE-2008-3791

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LXDE GPicView version 0.1.9

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rot.jpg temporary file. This is due to a flaw in the src/main-win.c file of GPicView.

Recommendations For GPicView version 0.1.9, consider restricting access to the /tmp directory to prevent symlink attacks until a patch is available. As a temporary workaround, avoid using GPicView to handle sensitive files or in environments where file integrity is crucial. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2008-3791

Affected Products

Gpicview

References · 10

• https://osv.dev/vulnerability/CVE-2008-3791 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-3791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3791 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3791 · Vendor Advisory
• http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495968 · Note
• http://lxde.svn.sourceforge.net/viewvc/lxde?view=rev&sortby=date&revision=845 · Note
• http://openwall.com/lists/oss-security/2008/08/26/5 · Note
• http://openwall.com/lists/oss-security/2008/08/25/3 · Note
• http://openwall.com/lists/oss-security/2008/08/26/10 · Note