Unscored CVE-2003-0656 EUVD-2003-0650GHSA-h3p8-3pq6-v8f2

eroaster before 2.2.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file that is used as a lockfile.

Published Aug 14, 2003 · Updated Aug 8, 2024 · Assigned by mitre

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 3.0	eroaster	2.1.0.0.3-2woody1	DSA-366

Advisories 1

DSA-366 eroaster - insecure temporary file Debian Security (DSA / DLA) · Mar 9, 2026

References

DSA-366 vendor-advisory
20030902 GLSA: eroaster (200309-04) mailing-list
MDKSA-2003:083 vendor-advisory