Unscored CVE-2019-17365 EUVD-2019-7772GHSA-4hrm-834j-j4f9

Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directori…

Published Oct 9, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Description

Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable.

References

http://www.openwall.com/lists/oss-security/2019/10/09/4
[oss-security] 20191010 Re: CVE-2019-17365: Nix per-user profile directory hijack mailing-list
[oss-security] 20191017 CVE-2019-18192: Insecure permissions on Guix profile directory mailing-list