Description
The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.3.2.ds1-19 | — |
| Debian 13 | glibc | 2.3.2.ds1-19 | — |
| Debian 12 | glibc | 2.3.2.ds1-19 | — |
References
- DSA-636 vendor-advisory
- RHSA-2005:261 vendor-advisory
- MDKSA-2004:159 vendor-advisory
- 20041028 [USN-4-1] Standard C library script vulnerabilities mailing-list