Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 10 articles for you...
91
security advisorygentoosoftware updateGentoo 200801-03 Advisory: Claws Mail Vulnerability in Symlink Attack
Claws Mail uses temporary files in an insecure manner, allowing for a symlink attack.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200801-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Claws Mail: Insecure temporary file creation Date: January 09, 2008 Bugs: #201244 ID: 200801-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Claws Mail uses temporary files in an insecure manner, allowing for a symlink attack. Background ========= Claws Mail is a GTK based e-mail client. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-client/claws-mail < 3.0.2-r1 > = 3.0.2-r1 Description ========== Nico Golde from Debian reported that the sylprint.pl script that is part of the Claws Mail tools creates temporary files in an insecure manner. Impact ===== A local attacker could exploit this vulnerability to conduct symlink attacks to overwrite files with the privileges of the user running Claws Mail. Workaround ========= There is no known workaround at this time. Resolution ========= All Claws Mail users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =mail-client/claws-mail-3.0.2-r1" References ========= [ 1 ] CVE-2007-6208 https://www.cve.org/CVERecord?id=CVE-2007-6208 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200801-03 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jan 09, 2008
Gentoo
91
security advisorygentoosymlink attackGentoo: GLSA-200709-04 Normal: po4a Insecure File Creation Risk
A vulnerability has been discovered in po4a, allowing for a symlink attack.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200709-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: po4a: Insecure temporary file creation Date: September 13, 2007 Bugs: #189440 ID: 200709-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability has been discovered in po4a, allowing for a symlink attack. Background ========= po4a is a set of tools for helping with the translation of documentation. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/po4a < 0.32-r1 > = 0.32-r1 Description ========== The po4a development team reported a race condition in the gettextize() function when creating the file "/tmp/gettextization.failed.po". Impact ===== A local attacker could perform a symlink attack, possibly overwriting files with the permissions of the user running po4a. Workaround ========= There is no known workaround at this time. Resolution ========= All po4a users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/po4a-0.32-r1" References ========= [ 1 ] CVE-2007-4462 https://www.cve.org/CVERecord?id=CVE-2007-4462 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200709-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuringthe confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 13, 2007
Gentoo
91
security advisorygentootemporary fileGentoo: GLSA-200703-20 Low-Level Risk from LSAT Symlink Attack
LSAT insecurely creates temporary files which can lead to symlink attacks allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200703-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: LSAT: Insecure temporary file creation Date: March 18, 2007 Bugs: #159542 ID: 200703-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= LSAT insecurely creates temporary files which can lead to symlink attacks allowing a local user to overwrite arbitrary files. Background ========= The Linux Security Auditing Tool (LSAT) is a post install security auditor which checks many system configurations and local network settings on the system for common security or configuration errors and for packages that are not needed. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/lsat
Mar 18, 2007
•Low
Gentoo
91
security advisorygentoofile overwriteGentoo: GLSA-202304-07 Normal: Noweb Vulnerable File Handling Exposure
noweb is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200602-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: noweb: Insecure temporary file creation Date: February 26, 2006 Bugs: #122705 ID: 200602-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= noweb is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. Background ========= noweb is a simple, extensible, and language independent literate programming tool. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/noweb < 2.9-r5 > = 2.9-r5 Description ========== Javier Fernandez-Sanguino has discovered that the lib/toascii.nw and shell/roff.mm scripts insecurely create temporary files with predictable filenames. Impact ===== A local attacker could create symbolic links in the temporary file directory, pointing to a valid file somewhere on the filesystem. When an affected script is called, this would result in the file being overwritten with the rights of the user running the script. Workaround ========= There is no known workaround at this time. Resolution ========= All noweb users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/noweb-2.9-r5" References ========= [ 1 ] CVE-2005-3342 Availability =========== This GLSA and any updates to it are available forviewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200602-14 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Feb 26, 2006
Gentoo
91
security advisoryGentoolocal exploitGentoo: GLSA 202310-01 Critical: GnuPG Vulnerability Exploit Risk
Texinfo is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200510-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Texinfo: Insecure temporary file creation Date: October 05, 2005 Bugs: #106105 ID: 200510-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Texinfo is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. Background ========= Texinfo is the official documentation system created by the GNU project. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/texinfo < 4.8-r1 > = 4.8-r1 Description ========== Frank Lichtenheld has discovered that the "sort_offline()" function in texindex insecurely creates temporary files with predictable filenames. Impact ===== A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When texindex is executed, this would result in the file being overwritten with the rights of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All Texinfo users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/texinfo-4.8-r1" References ========= [ 1 ] CAN-2005-3011 https://www.cve.org/CVERecord?id=CVE-CAN-2005-3011 Availability =========== This GLSA andany updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200510-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Oct 05, 2005
Gentoo
91
security advisorygentoofile overwriteUbuntu USN-2023-4265-1: Critical libcurl Vulnerability in Config Management
gtkdiskfree is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200510-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: gtkdiskfree: Insecure temporary file creation Date: October 03, 2005 Bugs: #104565 ID: 200510-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= gtkdiskfree is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. Background ========= gtkdiskfree is a GTK-based GUI to show free disk space. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/gtkdiskfree < 1.9.3-r1 > = 1.9.3-r1 Description ========== Eric Romang discovered that gtkdiskfree insecurely creates a predictable temporary file to handle command output. Impact ===== A local attacker could create a symbolic link in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gtkdiskfree is executed, this would result in the file being overwritten with the rights of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All gtkdiskfree users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-admin/gtkdiskfree-1.9.3-r1" References ========= [ 1 ] CAN-2005-2918 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2918 [ 2 ] Original Advisory Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200510-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Oct 03, 2005
Gentoo
91
security advisorygentoofile overwriteGentoo: GLSA-200506-11 High: WebApp Secure Failures in Configuration
LutelWall is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200506-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: LutelWall: Insecure temporary file creation Date: June 11, 2005 Bugs: #95378 ID: 200506-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= LutelWall is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. Background ========= LutelWall is a high-level Linux firewall configuration tool. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-firewall/lutelwall < 0.98 > = 0.98 Description ========== Eric Romang has discovered that the new_version_check() function in LutelWall insecurely creates a temporary file when updating to a new version. Impact ===== A local attacker could create symbolic links in the temporary file directory, pointing to a valid file somewhere on the filesystem. When the update script is executed (usually by the root user), this would result in the file being overwritten with the rights of this user. Workaround ========= There is no known workaround at this time. Resolution ========= All LutelWall users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-firewall/lutelwall-0.98" References ========= [ 1 ] CAN-2005-1879 https://www.cve.org/CVERecord?id=CVE-CAN-2005-1879 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200506-10 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jun 11, 2005
Gentoo
91
security advisorygentoosoftware updateDebian: 202209-23 Warning: Libtool, Python-sql Symlink Vulnerability
GNU shtool and ocaml-mysql are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200506-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GNU shtool, ocaml-mysql: Insecure temporary file creation Date: June 11, 2005 Bugs: #93782, #93784 ID: 200506-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= GNU shtool and ocaml-mysql are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. Background ========= GNU shtool is a compilation of small shell scripts into a single shell tool. The ocaml-mysql package includes the GNU shtool code. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-util/shtool < 2.0.1-r2 > = 2.0.1-r2 2 dev-ml/ocaml-mysql < 1.0.3-r1 > = 1.0.3-r1 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Eric Romang has discovered that GNU shtool insecurely creates temporary files with predictable filenames (CAN-2005-1751). On closer inspection, Gentoo Security discovered that the shtool temporary file, once created, was being reused insecurely (CAN-2005-1759). Impact ===== A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere onthe filesystem. When a GNU shtool script is executed, this would result in the file being overwritten with the rights of the user running the script, which could be the root user. Workaround ========= There is no known workaround at this time. Resolution ========= All GNU shtool users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-util/shtool-2.0.1-r2" All ocaml-mysql users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-ml/ocaml-mysql-1.0.3-r1" References ========= [ 1 ] CAN-2005-1751 [ 2 ] CAN-2005-1759 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200506-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jun 11, 2005
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!