A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Link | Tags |
---|---|
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724614 | |
http://osvdb.org/97769 | vdb entry |
http://seclists.org/oss-sec/2013/q3/660 | mailing list |
http://www.ubuntu.com/usn/USN-1979-1 | vendor advisory |