Input validation error in Fedora - CVE-2016-8605

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33794

Input validation error in Fedora - CVE-2016-8605

Published: January 13, 2017 / Updated: August 4, 2020


Vulnerability identifier: #VU33794
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8605
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.


Affected software

Fedora
Arch Linux
guile (Alpine package)
compat-guile18
guile

How to mitigate CVE-2016-8605

Install update from vendor's website.

guile (Alpine package) - addressed in versions 1.8.8-r3, 2.0.11-r3
compat-guile18 - addressed in versions 1.8.8-14.el7, 1.8.8-14.fc23, 1.8.8-14.fc24, 1.8.8-14.fc25
guile - addressed in versions 2.0.13-1.fc23, 2.0.13-1.fc24, 2.0.13-1.fc25

External References

Related Security Bulletins