Unscored CVE-2016-5026 EUVD-2016-5979GHSA-55hg-465f-gp62

hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.

Published Jan 30, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: onionshare Package: onionshare Ecosystem: Debian Ecosystem: Ubuntu

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	onionshare	0.8.1-2	—
Debian 13	onionshare	0.8.1-2	—
Debian 12	onionshare	0.8.1-2	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	onionshare	No fix yet	—

References

[oss-security] 20160523 CVE request: /tmp usage race condition in onionshare mailing-list
https://github.com/micahflee/onionshare
90821 vdb-entry
[oss-security] 20160524 Re: CVE request: /tmp usage race condition in onionshare mailing-list