Description
The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | readline6 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bash | 7.0-92.1 | openSUSE-SU-2024:10106-1 |
| openSUSE Tumbleweed | crash | 7.1.5_k4.8.13_1-3.51 | openSUSE-SU-2024:10111-1 |
Advisories 3
- openSUSE-SU-2024:10111-1 crash-7.1.5-3.51 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10106-1 bash-4.4-92.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1969 HPE Fabric OS: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Aug 6, 2023
References
- MDVSA-2014:154 vendor-advisory
- openSUSE-SU-2014:1226 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1077023
- FEDORA-2014-7523 vendor-advisory
- [oss-security] 20140317 Re: Insecure usage of temporary files in GNU Readline mailing-list
- MDVSA-2015:132 vendor-advisory
- http://advisories.mageia.org/MGASA-2014-0319.html
- [Bug-readline] 20140331 Readline-6.3 Official Patch 3 mailing-list
- [oss-security] 20140314 Insecure usage of temporary files in GNU Readline mailing-list