I don't believe a CVE has been assigned or requested for this yet. Spotted this on Debian's bug tracker and filed our own bug, the description of which follows which should serve to describe the issue. I'm not sure if this affects IBM's JDK, but it seems to affect Oracle's (based on a quick test on my mac), so cc'ing Oracle here. I'm not sure if MITRE will be handling the assignment or if Oracle will, but as this had already been reported publicly to the Debian BTS, I didn't think there was a point in _not_ sending this to oss-sec. Thanks. Jakub Wilk reported in a Debian bug report that the unpack200 program included in OpenJDK did not properly handle the logfile properly. If the the log file was unable to be opened, it would create /tmp/unpack.log instead as the fallback, but do so in an insecure manner, as shown in unpack.cpp (the below is from OpenJDK 6): 4732 void unpacker::redirect_stdio() { ... 4757 #else 4758 sprintf(tmpdir,"/tmp"); 4759 sprintf(log_file_name, "/tmp/unpack.log"); 4760 #endif 4761 if ((errstrm = fopen(log_file_name, "a+")) != NULL) { 4762 log_file = errstrm_name = saveStr(log_file_name); 4763 return ; 4764 } 4765 4766 char *tname = tempnam(tmpdir,"#upkg"); 4767 sprintf(log_file_name, "%s", tname); 4768 if ((errstrm = fopen(log_file_name, "a+")) != NULL) { 4769 log_file = errstrm_name = saveStr(log_file_name); 4770 return ; 4771 } The same exists in OpenJDK 7 and 8. This could allow a malicious local attacker to conduct local attacks, such as symlink attacks, where a file could be overwritten if the user running unpack200 had write permissions. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562 https://bugzilla.redhat.com/show_bug.cgi?id=1060907 -- Vincent Danen / Red Hat Security Response Team