CVE-2014-5459

php-pear: insecure temporary file use for cache data

The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Opensuse Oracle Php

Products

Evergreen Opensuse Solaris and 1 more

CVE-2013-4472

xpdf: insecure temporary file

The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2015-0267

kexec-tools: insecure use of /tmp/*$$* filenames

The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Kexec-tools

CVE-2014-8991

python-pip: local DoS vulnerability

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Oracle Pypa

Products

Solaris Pip

CVE-2013-6493

icedtea-web: insecure temporary file use flaw in LiveConnect implementation

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Icedtea-web

CVE-2013-6501

php: predictable file name used for cache in world writeable directory

The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Php Suse

Products

Php Linux Enterprise Server

CVE-2014-1932

python-imaging: insecure temporary file creation

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Python Pythonware

Products

Pillow Python Imaging Library

CVE-2014-0012

python-jinja2: FileSystemBytecodeCache insecure cache temporary file use, incorrect CVE-2014-1402 fix

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pocoo

Products

Jinja2

CVE-2014-0135

rubygem-kafo: temporary file creation vulnerability when creating /tmp/default_values.yaml

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Kafo

CVE-2014-2893

llvm: insecure temporary file handling in clang's scan-build utility

The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Llvm Opensuse

Products

Clang Opensuse

CVE-2013-6402

hplip: insecure temporary file handling in pkit.py

base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Hp

Products

Linux Imaging And Printing Project

CVE-2009-5044

groff: insecure temporary file handling in pdfroff

contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Gnu

Products

Mac Os X Groff

CVE-2009-5081

groff: roff2.pl and groffer.pl use easy-to-guess temporary file names

The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Groff

CVE-2010-4173

libsdp: insecure log file handling

The default configuration of libsdp.conf in libsdp 1.1.104 and earlier creates log files in /tmp, which allows local users to overwrite arbitrary files via a (1) symlink or (2) hard link attack on the libsdp.log.##### temporary file.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openfabrics

Products

Libsdp

CVE-2011-1920

mk-files: insecure temporary file usage

The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ihji Netbsd

Products

Pmake Netbsd

CVE-2011-2722

hplip: insecure temporary file handling

The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Hp Redhat

Products

Linux Imaging And Printing Project Enterprise Linux

CVE-2012-0860

rhev: vds_installer insecure /tmp use

Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Virtualization Manager Rhev Manager

CVE-2012-1989

puppet: Insecure temporary file use for NET::Telnet connection log (/tmp/out.log)

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Puppet Puppetlabs

Products

Puppet Puppet Enterprise Puppet

CVE-2012-4454

opencryptoki: insecure handling of files in the /tmp directory

openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.

CVSS 2.0 · 2.9 Low EPSS 1.1% KEV · Not listed

Vendors

Opencryptoki Project

Products

Opencryptoki

CVE-2012-4455

opencryptoki: insecure handling of files in the /tmp directory

openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Opencryptoki Project

Products

Opencryptoki