CVE-2007-5377

Tramp 2.1.10 - Arbitrary File Overwrite via Symlink Attack on Temporary Files

Title source: llm

Description

The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

References (8)

Core 8

Core References

Various Sources mailing-list x_refsource_mlist

http://lists.gnu.org/archive/html/emacs-devel/2007-10/msg00158.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27244

Issue Tracking x_refsource_confirm

http://bugs.gentoo.org/show_bug.cgi?id=194713

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27343

Various Sources mailing-list x_refsource_mlist

http://lists.gnu.org/archive/html/emacs-devel/2007-10/msg00132.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200710-22.xml

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/41752

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/26072

Scores

EPSS 0.0003

EPSS Percentile 8.3%

Details

CWE

CWE-59

Status published

Products (1)

gnu/tramp 2.1.10

Published Oct 12, 2007

Tracked Since Feb 18, 2026