CVE-2015-7758 : Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack

Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.

Published 2016-01-08 19:59:09

Updated 2018-10-30 16:27:36

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-7758

Opensuse » Opensuse » Version: 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.1
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 42.1
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Matching versions
Gummi Project » Gummi » Version: 0.6.5
cpe:2.3:a:gummi_project:gummi:0.6.5:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-7758

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-7758

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
3.3	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2015-7758

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-7758

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178582.html

[SECURITY] Fedora 22 Update: gummi-0.6.6-1.fc22
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756432

#756432 - gummi: Uses predictable filenames in /tmp based on basename (CVE-2015-7758) - Debian Bug report logs
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2015-12/msg00117.html

openSUSE-SU-2015:2369-1: moderate: Security update for gummi
http://www.openwall.com/lists/oss-security/2015/10/08/5

oss-security - Re: CVE request: Gummi
http://lists.opensuse.org/opensuse-updates/2016-02/msg00150.html

openSUSE-SU-2016:0574-1: moderate: Security update for gummi
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178642.html

[SECURITY] Fedora 23 Update: gummi-0.6.6-1.fc23
http://www.openwall.com/lists/oss-security/2015/10/08/4

oss-security - CVE request: Gummi

Jump to

Vulnerability Details : CVE-2015-7758

Products affected by CVE-2015-7758

Exploit prediction scoring system (EPSS) score for CVE-2015-7758

CVSS scores for CVE-2015-7758

CWE ids for CVE-2015-7758

References for CVE-2015-7758