Vulnerability CVE-2014-4978
Published: 2017-12-29

Description:
The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.

Type:

CWE-59

 (Improper Link Resolution Before File Access ('Link Following'))

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.6/10
4.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Rawstudio -> Rawstudio 
Fedoraproject -> Fedora 

 References:
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162109.html
http://www.openwall.com/lists/oss-security/2014/07/16/15
http://www.securityfocus.com/bid/68671
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754899
https://bugzilla.redhat.com/show_bug.cgi?id=1120093
https://exchange.xforce.ibmcloud.com/vulnerabilities/94633
https://github.com/rawstudio/rawstudio/commit/9c2cd3c93c05d009a91d84eedbb85873b0cb505d
Copyright 2024, cxsecurity.com

 

Back to Top