5.5

CVE-2011-2924

foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linuxfoundation ≫ Foomatic-filters Version <= 4.0.12
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Fedoraproject ≫ Fedora Version 14
Fedoraproject ≫ Fedora Version 15
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.345
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NIST 3.3 3.4 4.9
AV:L/AC:M/Au:N/C:N/I:P/A:P
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://access.redhat.com/security/cve/cve-2011-2924
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2924
Third Party Advisory
Issue Tracking
https://launchpad.net/ubuntu/+source/foomatic-filters/4.0.12-1
Third Party Advisory
Release Notes
https://lwn.net/Articles/459979/
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2924
Third Party Advisory
https://www.openwall.com/lists/oss-security/2014/02/08/5/1
Third Party Advisory
Mailing List