Skip to content
OpenAdvisories
Unscored CVE-2012-0786 EUVD-2012-0817GHSA-v2f6-mg42-536m

The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive info…

Published Nov 23, 2013 · Updated Aug 6, 2024 · Assigned by redhat

Description

The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 augeas 1.0.0-1 —
Debian 13 augeas 1.0.0-1 —
Debian 12 augeas 1.0.0-1 —
Debian 6.0 augeas 0.7.2-1+deb6u1 DLA-28-1
ReleasePackageFixed inAdvisory
RHEL 6 augeas +2 1.0.0-5.el6 RHSA-2013:1537
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Gluster Storage 3 augeas 1.0.0-5.el6 RHSA-2013:1537

Advisories 2

References