CVE-2013-4136

N/A

Description

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

CVE Details

CVSS v3.1 ScoreN/A

Published9/30/2013

Last Modified4/11/2025

Sourcenvd

Honeypot Sightings0

Affected Products

phusion:passengerruby-lang:ruby

Weaknesses (CWE)

CWE-59

References

http://rhn.redhat.com/errata/RHSA-2013-1136.html(secalert@redhat.com)

http://www.openwall.com/lists/oss-security/2013/07/16/6(secalert@redhat.com)

https://code.google.com/p/phusion-passenger/issues/detail?id=910(secalert@redhat.com)

https://github.com/phusion/passenger/blob/release-4.0.6/NEWS(secalert@redhat.com)

https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2013-1136.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2013/07/16/6(af854a3a-2127-422b-91ae-364da2661108)

https://code.google.com/p/phusion-passenger/issues/detail?id=910(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/phusion/passenger/blob/release-4.0.6/NEWS(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.