| Vulnerability Name: | CVE-2014-1859 (CCN-91317) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2014-02-13 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2014-02-13 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2019-04-22 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N) 1.8 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
2.9 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-59 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | File Manipulation | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2014-1859 Source: FEDORA Type: Issue Tracking, Third Party Advisory FEDORA-2014-2289 Source: FEDORA Type: Issue Tracking, Third Party Advisory FEDORA-2014-2387 Source: CCN Type: NumPy Web site NumPy Source: MLIST Type: Issue Tracking, Mailing List, Patch, Third Party Advisory [oss-security] 20140207 Re: CVE request: f2py insecure temporary file use Source: BID Type: Third Party Advisory, VDB Entry 65440 Source: CCN Type: BID-65440 NumPy 'mktemp' Insecure Temporary File Creation Vulnerability Source: CONFIRM Type: Issue Tracking, Patch, Third Party Advisory https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778 Source: CONFIRM Type: Issue Tracking, Patch https://bugzilla.redhat.com/show_bug.cgi?id=1062009 Source: CCN Type: Red Hat Bugzilla Bug 1064951 CVE-2014-1858 CVE-2014-1859 numpy: f2py insecure temporary file use [epel-5] Source: XF Type: Issue Tracking, Third Party Advisory, VDB Entry numpy-cve20141859-symlink(91317) Source: XF Type: UNKNOWN numpy-cve20141859-symlink(91317) Source: CONFIRM Type: Patch, Third Party Advisory https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst Source: CONFIRM Type: Patch, Third Party Advisory https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 Source: CONFIRM Type: Issue Tracking, Patch, Third Party Advisory https://github.com/numpy/numpy/pull/4262 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||