CVE-2013-4136

N/A

Descricao

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Detalhes CVE

Pontuacao CVSS v3.1N/A

Publicado9/30/2013

Ultima modificacao4/11/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

phusion:passengerruby-lang:ruby

Fraquezas (CWE)

CWE-59

Referencias

http://rhn.redhat.com/errata/RHSA-2013-1136.html(secalert@redhat.com)

http://www.openwall.com/lists/oss-security/2013/07/16/6(secalert@redhat.com)

https://code.google.com/p/phusion-passenger/issues/detail?id=910(secalert@redhat.com)

https://github.com/phusion/passenger/blob/release-4.0.6/NEWS(secalert@redhat.com)

https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2013-1136.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2013/07/16/6(af854a3a-2127-422b-91ae-364da2661108)

https://code.google.com/p/phusion-passenger/issues/detail?id=910(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/phusion/passenger/blob/release-4.0.6/NEWS(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.