4.4

CVE-2009-1962

Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.

Data is provided by the National Vulnerability Database (NVD)
Xfig ≫ Xfig Version3.2.5
Debian ≫ Debian Linux Version4.0 Editionalpha
Debian ≫ Debian Linux Version4.0 Editionamd64
Debian ≫ Debian Linux Version4.0 Editionarm
Debian ≫ Debian Linux Version4.0 Editionhppa
Debian ≫ Debian Linux Version4.0 Editionia-32
Debian ≫ Debian Linux Version4.0 Editionia-64
Debian ≫ Debian Linux Version4.0 Editionm68k
Debian ≫ Debian Linux Version4.0 Editionmips
Debian ≫ Debian Linux Version4.0 Editionmipsel
Debian ≫ Debian Linux Version4.0 Editionpowerpc
Debian ≫ Debian Linux Version4.0 Editionsparc
Debian ≫ Debian Linux Version5.0 Editionalpha
Debian ≫ Debian Linux Version5.0 Editionamd64
Debian ≫ Debian Linux Version5.0 Editionarm
Debian ≫ Debian Linux Version5.0 Editionarmel
Debian ≫ Debian Linux Version5.0 Editionhppa
Debian ≫ Debian Linux Version5.0 Editionia-32
Debian ≫ Debian Linux Version5.0 Editionia-64
Debian ≫ Debian Linux Version5.0 Editionm68k
Debian ≫ Debian Linux Version5.0 Editionmips
Debian ≫ Debian Linux Version5.0 Editionmipsel
Debian ≫ Debian Linux Version5.0 Editionpowerpc
Debian ≫ Debian Linux Version5.0 Editionsparc
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.266
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.