Description
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rot.jpg temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpicview | 0.1.9-2 | — |
| Debian 13 | gpicview | 0.1.9-2 | — |
| Debian 12 | gpicview | 0.1.9-2 | — |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495968
- [oss-security] 20080826 Re: CVE Request (gpicview) mailing-list
- http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
- [oss-security] 20080825 CVE Request (gpicview) mailing-list
- [oss-security] 20080826 Re: CVE Request (gpicview) mailing-list
- http://lxde.svn.sourceforge.net/viewvc/lxde?view=rev&sortby=date&revision=845