Main Vulnerability Database Vulnerabilities #VU42512

Link following in txt2man - CVE-2013-1444

Published: October 1, 2013 / Updated: August 10, 2020

Vulnerability identifier: #VU42512

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-1444

CWE-ID: CWE-59

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.

Affected software

txt2man
Ubuntu
txt2man (Ubuntu package)

How to mitigate CVE-2013-1444

Install update from vendor's website.

txt2man (Ubuntu package) - addressed in versions 1.5.5-4ubuntu0.12.04.1, 1.5.5-4ubuntu0.12.10.1, 1.5.5-4ubuntu0.13.04.1

External References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724614
http://osvdb.org/97769
http://seclists.org/oss-sec/2013/q3/660
http://www.ubuntu.com/usn/USN-1979-1

Related Security Bulletins