Description
fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause a denial of service (prevention of system updates).
References
- FEDORA-2014-14027 vendor-advisory
- FEDORA-2014-14347 vendor-advisory
- FEDORA-2014-14252 vendor-advisory
- https://github.com/wgwoods/fedup/issues/44
- https://bugzilla.redhat.com/show_bug.cgi?id=1066679
- 70874 vdb-entry