Description
The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | antiword | 0.35-2 | — |
| Debian 13 | antiword | 0.35-2 | — |
| Debian 12 | antiword | 0.35-2 | — |
| Debian 3.0 | antiword | 0.32-2woody0 | DSA-945-1 |
Advisories 1
- DSA-945-1 antiword - insecure temporary file Debian Security (DSA / DLA) · Mar 9, 2026
References
- 15866 third-party-advisory
- ADV-2006-0242 vdb-entry
- 16278 vdb-entry
- antiword-tmp-file-symlink(24194) vdb-entry
- 18530 third-party-advisory
- DSA-945 vendor-advisory