CVE-2011-4617

virtualenv < 1.5 - Arbitrary File Overwrite via Symlink Attack

Title source: llm
STIX 2.1

Description

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

References (7)

Core 7
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47240
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/12/19/4
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/12/19/2
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071638.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071643.html
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/12/19/5

Scores

EPSS 0.0004
EPSS Percentile 11.4%

Details

CWE
CWE-59
Status published
Products (28)
pypi/virtualenv 0 - 1.5PyPI
python/virtualenv 0.8
python/virtualenv 0.8.1
python/virtualenv 0.8.2
python/virtualenv 0.8.3
python/virtualenv 0.8.4
python/virtualenv 0.9
python/virtualenv 0.9.1
python/virtualenv 0.9.2
python/virtualenv 1.0
... and 18 more
Published Dec 31, 2011
Tracked Since Feb 18, 2026