Vulnerability in Devscripts_devel_team Devscripts
CVE-2012-3500
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
Vulnerability class: Race Condition
EPSS: 0.003 (18.9th percentile) — read the EPSS interpretation.
Affected products
- Devscripts_devel_team Devscripts — versions 2.12.0
- Fedora Rpmdevtools
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (vdb-entry, x_refsource_XF)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)