Description
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ed | 0.2-19 | — |
| Debian 13 | ed | 0.2-19 | — |
| Debian 12 | ed | 0.2-19 | — |
References
- gnued-opensbuf-symlink(30374) vdb-entry
- MDKSA-2007:023 vendor-advisory
- 2007-0005 vendor-advisory
- 23832 third-party-advisory
- 23857 third-party-advisory
- FEDORA-2007-099 vendor-advisory
- 23848 third-party-advisory
- 22129 vdb-entry
- FEDORA-2007-100 vendor-advisory
- 24054 third-party-advisory
- ADV-2006-4573 vdb-entry
- http://freshmeat.net/projects/ed/?branch_id=17855&release_id=240890
- https://issues.rpath.com/browse/RPL-962