Vulnerability in GNU Guile
CVE-2016-8605
The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.028 (85.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 85.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.028 · newest: 0.028 · change: 0.000
Affected products
- GNU Guile
- Fedoraproject Fedora — versions 23, 24, 25
Weakness classification (CWE)
References
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.securityfocus.com/bid/93510 (VDB Entry, Third Party Advisory, vdb-entry)
- www.openwall.com/lists/oss-security/2016/10/12/1 (mailing-list, Patch, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2016-8605?
- CVE-2016-8605 is a medium-severity vulnerability in GNU Guile, classified under Permission Issues. CVSS score: 5.3/10. Published 2017-01-12.
- How severe is CVE-2016-8605?
- Medium severity. CVSS v3 base score is 5.3 out of 10.