6.3

CVE-2011-3616

Exploit
The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Conky ≫ Conky Version <= 1.8.1
Conky ≫ Conky Version1.1
Conky ≫ Conky Version1.2
Conky ≫ Conky Version1.3.0
Conky ≫ Conky Version1.3.1
Conky ≫ Conky Version1.3.2
Conky ≫ Conky Version1.3.3
Conky ≫ Conky Version1.3.4
Conky ≫ Conky Version1.3.5
Conky ≫ Conky Version1.4.0
Conky ≫ Conky Version1.4.1
Conky ≫ Conky Version1.4.2
Conky ≫ Conky Version1.4.3
Conky ≫ Conky Version1.4.4
Conky ≫ Conky Version1.4.5
Conky ≫ Conky Version1.4.6
Conky ≫ Conky Version1.4.7
Conky ≫ Conky Version1.4.8
Conky ≫ Conky Version1.4.9
Conky ≫ Conky Version1.5.0
Conky ≫ Conky Version1.5.1
Conky ≫ Conky Version1.6.0
Conky ≫ Conky Version1.6.1
Conky ≫ Conky Version1.7.0
Conky ≫ Conky Version1.7.1
Conky ≫ Conky Version1.7.1.1
Conky ≫ Conky Version1.7.2
Conky ≫ Conky Version1.8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.337
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.3 3.4 9.2
AV:L/AC:M/Au:N/C:N/I:C/A:C
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612033
Exploit
http://secunia.com/advisories/43225
Vendor Advisory
http://secunia.com/advisories/46353
Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-201110-09.xml
http://www.openwall.com/lists/oss-security/2011/10/09/4
http://www.openwall.com/lists/oss-security/2011/10/10/8
https://bugs.launchpad.net/ubuntu/+source/conky/+bug/607309