viewpatch in mgdiff 1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

References

• mgdiff-viewpatch-symlink(22846) vdb-entry
• 15180 vdb-entry
• 17299 third-party-advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=335188