CVE-2007-3103 : The init.d script for the X.Org X11 xfs font server on various Linux distributio

The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.

Published 2007-07-15 22:30:00

Updated 2018-10-16 16:47:28

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2007-3103

Redhat » Linux
cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 4.0 AS Edition
cpe:2.3:o:redhat:enterprise_linux:4.0:*:as:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 4.0 ES Edition
cpe:2.3:o:redhat:enterprise_linux:4.0:*:es:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 4.0 WS Edition
cpe:2.3:o:redhat:enterprise_linux:4.0:*:ws:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 4.0
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora Core » Version: 6.0
cpe:2.3:o:fedoraproject:fedora_core:6.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2007-3103

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-3103

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.2	MEDIUM	AV:L/AC:H/Au:N/C:C/I:C/A:C	1.9	10.0	NIST
Access Vector: Local Access Complexity: High Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2007-3103

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-3103

Jump to

Vulnerability Details : CVE-2007-3103

Products affected by CVE-2007-3103

Exploit prediction scoring system (EPSS) score for CVE-2007-3103

CVSS scores for CVE-2007-3103

CWE ids for CVE-2007-3103

References for CVE-2007-3103