CVE-2009-5044

groff: insecure temporary file handling in pdfroff

contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Gnu

Products

Mac Os X Groff

CVE-2009-5081

groff: roff2.pl and groffer.pl use easy-to-guess temporary file names

The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Groff

CVE-2012-0860

rhev: vds_installer insecure /tmp use

Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Virtualization Manager Rhev Manager

CVE-2012-5509

aeolus-configserver: aeolus-configserver-setup /tmp file conductor credentials leak

aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for a temporary file in /tmp, which allows local users to read credentials by reading this file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Cloudforms Cloudengine Redhat

Products

1 Cloudforms Cloud Engine

CVE-2012-5530

pcp: Insecure temporary file use flaws

The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Sgi

Products

Performance Co-pilot

CVE-2012-5635

GlusterFS: insecure temporary file creation

The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Gluster Redhat

Products

Glusterfs Storage Storage Management Console and 2 more

CVE-2013-2029

core: Insecure temporary file usage in nagios.upgrade_to_v3.sh

nagios.upgrade_to_v3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to overwrite arbitrary files via a symlink attack on a temporary nagioscfg file with a predictable name in /tmp/.

CVSS 2.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openstack

CVE-2013-2035

HawtJNI: predictable temporary file name leading to local arbitrary code execution

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Fuse Mq Enterprise Hawtjni Jboss Amq and 9 more

CVE-2013-4373

Drift: Malicious drift file import due to insecure temporary file usage

The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files.

CVSS 2.0 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Operations Network

CVE-2013-4419

libguestfs: insecure temporary directory handling for guestfish's network socket

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libguestfs Novell Redhat and 1 more

Products

Libguestfs Suse Linux Enterprise Server Enterprise Linux and 1 more

CVE-2014-1876

OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)

The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Openjdk Enterprise Linux Network Satellite and 2 more

CVE-2013-0164

openshift-origin-port-proxy: openshift-port-proxy-cfg lockwrap() tmp file creation

The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Origin

CVE-2010-4173

libsdp: insecure log file handling

The default configuration of libsdp.conf in libsdp 1.1.104 and earlier creates log files in /tmp, which allows local users to overwrite arbitrary files via a (1) symlink or (2) hard link attack on the libsdp.log.##### temporary file.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openfabrics

Products

Libsdp

CVE-2011-1920

mk-files: insecure temporary file usage

The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ihji Netbsd

Products

Pmake Netbsd

CVE-2011-2722

hplip: insecure temporary file handling

The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Hp Redhat

Products

Linux Imaging And Printing Project Enterprise Linux

CVE-2011-3871

puppet: predictable temporary file using RAL

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Puppet Puppetlabs

Products

Puppet Puppet

CVE-2012-1088

iproute: multiple insecure temporary file use issues

iproute2 before 3.3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file used by (1) configure or (2) examples/dhcp-client-script.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Iproute2 Project

Products

Iproute2

CVE-2012-1989

puppet: Insecure temporary file use for NET::Telnet connection log (/tmp/out.log)

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Puppet Puppetlabs

Products

Puppet Puppet Enterprise Puppet

CVE-2012-2451

perl-Config-IniFiles: insecure temporary file usage

The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Shlomi Fish

Products

Config-inifiles

CVE-2012-3504

crypto-utils: insecure temporary file usage in genkey

The nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite arbitrary files via a symlink attack on the "list" file in the current working directory.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject

Products

Crypto-utils