ID CVE-2007-6358
Summary pdftops.pl before 1.20 in alternate pdftops filter allows local users to overwrite arbitrary files via a symlink attack on the pdfin.[PID].tmp temporary file, which is created when pdftops reads a PDF file from stdin, such as when pdftops is invoked by CUPS.
References
Vulnerable Configurations
  • cpe:2.3:a:glyph_and_cog:pdftops:*:*:*:*:*:*:*:*
    cpe:2.3:a:glyph_and_cog:pdftops:*:*:*:*:*:*:*:*
CVSS
Base: 4.9 (as of 16-11-2017 - 02:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE COMPLETE NONE
cvss-vector via4 AV:L/AC:L/Au:N/C:N/I:C/A:N
refmap via4
bid 26919
confirm
debian DSA-1437
gentoo GLSA-200712-14
osvdb 42029
secunia
  • 28113
  • 28139
  • 28200
  • 28386
ubuntu USN-563-1
statements via4
contributor Mark J Cox
lastmodified 2007-12-18
organization Red Hat
statement Not vulnerable. Red Hat Enterprise Linux versions 2.1, 3, 4 and 5 do not ship with the alternate pdftops.pl CUPS printing filter that is affected by this flaw.
Last major update 16-11-2017 - 02:29
Published 15-12-2007 - 01:46
Back to Top