CVE-2008-5298 - chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause

CVE-2008-5298

Summary

chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501959
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053501.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053510.html
http://secunia.com/advisories/32257
http://secunia.com/advisories/43109
http://www.securityfocus.com/bid/31735
http://www.vupen.com/english/advisories/2011/0236
https://exchange.xforce.ibmcloud.com/vulnerabilities/45813
https://exchange.xforce.ibmcloud.com/vulnerabilities/47030

Vulnerable Configurations

cpe:2.3:a:karakas-online:chm2pdf:0.9:*:*:*:*:*:*:*
cpe:2.3:a:karakas-online:chm2pdf:0.9:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 08-08-2017 - 01:33)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:N/I:N/A:P

refmap via4

bid	31735
confirm	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501959
fedora	FEDORA-2011-0454 FEDORA-2011-0467
secunia	32257 43109
vupen	ADV-2011-0236
xf	chm2pdf-chm2pdf-symlink(45813) chm2pdf-files-dos(47030)

Last major update

08-08-2017 - 01:33

Published

01-12-2008 - 15:30

Last modified

08-08-2017 - 01:33