Unscored CVE-2015-4155 EUVD-2015-4179GHSA-gcr9-32r6-7cx2

GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to a…

Published Jun 2, 2015 · Updated Aug 6, 2024 · Assigned by mitre

Package: parallel Package: parallel Ecosystem: Debian Ecosystem: Ubuntu

Description

GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	parallel	20161222-1	—
Debian 13	parallel	20161222-1	—
Debian 12	parallel	20161222-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	parallel	20161222-1~ubuntu0.16.04.1	—

References

[parallel] 20150423 GNU Parallel Security Advisory: GNU Parallel can be tricked into overwriting a file mailing-list
[parallel] 20150522 GNU Parallel 20150522 ('Nepal') released [stable] mailing-list
74962 vdb-entry