3.3

CVE-2011-2533

The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freedesktop ≫ Dbus Version 1.2.1
Freedesktop ≫ Dbus Version 1.2.3
Freedesktop ≫ Dbus Version 1.2.4
Freedesktop ≫ Dbus Version 1.2.6
Freedesktop ≫ Dbus Version 1.2.8
Freedesktop ≫ Dbus Version 1.2.10
Freedesktop ≫ Dbus Version 1.2.12
Freedesktop ≫ Dbus Version 1.2.14
Freedesktop ≫ Dbus Version 1.2.16
Freedesktop ≫ Dbus Version 1.2.18
Freedesktop ≫ Dbus Version 1.2.20
Freedesktop ≫ Dbus Version 1.2.22
Freedesktop ≫ Dbus Version 1.2.24
Freedesktop ≫ Dbus Version 1.2.26
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.201
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.3 3.4 4.9
AV:L/AC:M/Au:N/C:N/I:P/A:P
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

http://cgit.freedesktop.org/dbus/dbus/tree/NEWS?h=dbus-1.2
http://www.securitytracker.com/id?1025720
https://exchange.xforce.ibmcloud.com/vulnerabilities/68173