Poppler and Xpdf Insecure Temporary File Creation Vulnerability
BID:63365
Info
Poppler and Xpdf Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 63365 |
| Class: | Race Condition Error |
| CVE: |
CVE-2013-4472 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 26 2013 12:00AM |
| Updated: | Nov 01 2013 01:11AM |
| Credit: | Pedro Ribeiro |
| Vulnerable: |
Foolabs Xpdf 3.02 Foolabs Xpdf 3.01 Foolabs Xpdf 3.00 |
| Not Vulnerable: | |
Discussion
Poppler and Xpdf Insecure Temporary File Creation Vulnerability
Poppler and Xpdf are prone to an insecure temporary file-creation vulnerability because they create temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.
Poppler and Xpdf are prone to an insecure temporary file-creation vulnerability because they create temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.
Exploit / POC
Poppler and Xpdf Insecure Temporary File Creation Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
References
Poppler and Xpdf Insecure Temporary File Creation Vulnerability
References:
References:
- Poppler Homepage (Poppler)
- Xpdf Homepage (Xpdf)