Description
wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
References
- 25686 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294352
- wmfrog-wmfrog-symlink(34924) vdb-entry
- wmfrog-symlink(18232) vdb-entry
- 24504 vdb-entry
- 13259 third-party-advisory
- 11743 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=516070&group_id=67429
- ADV-2007-2238 vdb-entry
- 12118 vdb-entry
- http://wmfrog.svn.sourceforge.net/svnroot/wmfrog/wmfrog/CHANGES