Information disclosure in Tryton - CVE-2016-1242

Vulnerability identifier: #VU40129

CSH Severity: Low

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-1242

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to gain access to sensitive information.

file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.

Tryton
Fedora
python-proteus
trytond-account-invoice
trytond-account-product
trytond-account-statement
trytond-google-maps
trytond-party
trytond-account
trytond-company
trytond-purchase
trytond-sale
trytond-stock
tryton
trytond

Install update from vendor's website.

python-proteus - update to 4.0.2-1.fc25
trytond-account-invoice - update to 4.0.2-1.fc25
trytond-account-product - update to 4.0.2-1.fc25
trytond-account-statement - update to 4.0.2-1.fc25
trytond-google-maps - update to 4.0.2-1.fc25
trytond-party - update to 4.0.2-1.fc25
trytond-account - update to 4.0.3-1.fc25
trytond-company - update to 4.0.3-1.fc25
trytond-purchase - update to 4.0.3-1.fc25
trytond-sale - update to 4.0.3-1.fc25
trytond-stock - update to 4.0.3-1.fc25
tryton - update to 4.0.4-1.fc25
trytond - update to 4.0.4-1.fc25

• http://www.debian.org/security/2016/dsa-3656
• http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html
• https://bugs.tryton.org/issue5808

• Multiple vulnerabilities in Python Tryton
• Fedora 25 update for python-proteus, tryton, trytond, trytond-account, trytond-account-invoice, trytond-account-product, trytond-account-statement, trytond-company, trytond-google-maps, trytond-party, trytond-purchase, trytond-sale, trytond-stock