CVE-2014-1624

Description

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Risk Information

Base Score

4.0

MODERATE

Vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS Score

Exploitation Probability

0.046

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-1624,CVE-2019-12761 are fixed in Python-pyxdg 0.26	Windows
SUSE-SU-2019:2719-1(SUSE Linux Enterprise Desktop 12-SP4 ) python-xdg-0.25-9.3.1.noarch.rpm	Linux
SUSE-SU-2019:2719-2(SUSE Linux Enterprise Server 12-SP5 ) python-xdg-0.25-9.3.1.noarch.rpm	Linux
Vulnerabilities CVE-2014-1624,CVE-2019-12761 are fixed in Python-pyxdg for linux 0.26	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234