Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-1639

syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.

Published

2014-01-28T00:55:04.177

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.3 (LOW)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Access Vector: LOCAL
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.4

Impact Score

4.9

Weaknesses

Type: Primary
CWE-59

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	debian	syncevolution	≤ 1.3.99.6	Yes

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357 Vendor Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2014/01/22/3 ([email protected])
http://www.openwall.com/lists/oss-security/2014/01/22/4 ([email protected])
http://www.osvdb.org/102380 ([email protected])
http://www.securityfocus.com/bid/65098 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/90662 ([email protected])
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2014/01/22/3 (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2014/01/22/4 (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/102380 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/65098 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/90662 (af854a3a-2127-422b-91ae-364da2661108)