Medium · 5.5 CVE-2014-4994 EUVD-2018-0153GHSA-6x45-86q6-rcmr

Gyazo allows local users to write arbitrary files

Published Jan 10, 2018 · Updated Aug 6, 2024 · Assigned by mitre

Description

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	gyazo	>= 1.0.0, < 2.0.0	2.0.0	GHSA-6x45-86q6-rcmr

References

[oss-security] 20140717 Re: Vulnerability Report for Ruby Gem codders-dataset-1.3.2.1 (etc.) mailing-list
[oss-security] 20140707 Vulnerability Report for Ruby Gem gyazo-1.0.0 mailing-list
http://www.vapid.dhs.org/advisories/gyazo-1.0.0.html