Description
Crossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local attacker can first create a world-writable subdirectory in a certain location under the /tmp directory, wait until a user process copies xr there, and then replace the entire contents of this subdirectory to include a Trojan horse xr.
References (1)
Core 1
Core References
Issue Tracking, Mailing List, Vendor Advisory x_refsource_misc
https://bugs.debian.org/911877
Scores
CVSS v3
7.8
EPSS
0.0003
EPSS Percentile
8.0%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-732
Status
published
Products (1)
debian/crossroads
2.81
Published
Oct 26, 2018
Tracked Since
Feb 18, 2026