| Vulnerability Name: | CVE-2014-1858 (CCN-91318) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2014-02-13 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2014-02-13 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2018-01-30 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N) 1.8 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
2.9 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | File Manipulation | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2014-1858 Source: FEDORA Type: Third Party Advisory FEDORA-2014-2289 Source: FEDORA Type: Third Party Advisory FEDORA-2014-2387 Source: CCN Type: NumPy Web site NumPy Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20140207 Re: CVE request: f2py insecure temporary file use Source: BID Type: Third Party Advisory, VDB Entry 65441 Source: CCN Type: BID-65441 NumPy '__init__.py' Insecure Temporary File Creation Vulnerability Source: CONFIRM Type: Mailing List, Third Party Advisory https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778 Source: CONFIRM Type: Issue Tracking, Third Party Advisory https://bugzilla.redhat.com/show_bug.cgi?id=1062009 Source: CCN Type: Red Hat Bugzilla Bug 1064951 CVE-2014-1858 CVE-2014-1859 numpy: f2py insecure temporary file use [epel-5] Source: XF Type: Third Party Advisory, VDB Entry numpy-cve20141858-symlink(91318) Source: XF Type: UNKNOWN numpy-cve20141858-symlink(91318) Source: CONFIRM Type: Third Party Advisory https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst Source: CONFIRM Type: Third Party Advisory https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 Source: CONFIRM Type: Third Party Advisory https://github.com/numpy/numpy/pull/4262 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||