gummi: predictable filenames in /tmp
| Package(s): | gummi | CVE #(s): | CVE-2015-7758 | ||||||||||||||||
| Created: | December 28, 2015 | Updated: | February 25, 2016 | ||||||||||||||||
| Description: | From the Debian bug report:
Package: gummi I opened a file called thesis.tex in gummi, this created the following files in /tmp:
-rw-r--r-- 1 jak jak 3196 Jul 29 21:39 .thesis.tex.aux Obviously, this has serious implications for multi-user systems, because two users editing a file with the same name would write to the same files in /tmp. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
