Eric Romang

**Name of the Vulnerable Software and Affected Versions** Flexbackup versions 1.2.1 and earlier **Description** The issue allows local users to overwrite files and execute code via a symlink attack on temporary files. **Recommendations** For Flexbackup versions 1.2.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ebuild IndeX (eix) versions prior to 0.5.0 pre2 **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on the exi.X.sync temporary file, which is processed by the diff-eix program. This is a second-order symlink vulnerability in eix-sync.in. **Recommendations** For versions prior to 0.5.0 pre2, update to version 0.5.0 pre2 or later to resolve the issue. As a temporary workaround, consider restricting access to the diff-eix program and the exi.X.sync temporary file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.1.0 and versions 4.4 before 4.4.1 **Description** The issue allows attackers to cause a denial of service, resulting in a segmentation fault. This can be achieved by manipulating the `session.save path` option in a .htaccess file or VirtualHost. **Recommendations** For versions prior to 5.1.0, update to version 5.1.0 or later to resolve the issue. For version 4.4, update to version 4.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `session.save path` option in .htaccess files or VirtualHost configurations until a patch is available.

**Name of the Vulnerable Software and Affected Versions** apachetop versions 0.12.5 and earlier **Description** The issue allows local users to create or append to arbitrary files via a symlink attack on `atop.debug` when running in debug mode. **Recommendations** For versions 0.12.5 and earlier, consider disabling debug mode to prevent the symlink attack until a patch is available. Restrict access to the `atop.debug` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** bacula versions 1.36.3 and earlier **Description** The issue allows local users to modify or read sensitive files via symlink attacks on the temporary file used by autoconf/randpass when openssl is not available, or the mtx.[PID] temporary file in mtx-changer.in. **Recommendations** For bacula versions 1.36.3 and earlier, consider restricting access to the temporary files used by autoconf/randpass and mtx-changer.in to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ncompress versions 4.2.4 and earlier **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files using (1) zdiff or (2) zcmp. **Recommendations** For versions 4.2.4 and earlier, consider restricting access to the zdiff and zcmp functions until a patch is available. As a temporary workaround, avoid using the zdiff and zcmp functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** arc versions 5.21j and earlier **Description** The issue allows local users to read sensitive information from temporary files created by the software. This is due to the software creating temporary files with world-readable permissions. The affected components include (1) arc (arc.c) and (2) marc (marc.c). **Recommendations** For arc versions 5.21j and earlier, consider restricting access to sensitive information until a patch is available. As a temporary workaround, avoid using the `arc` and `marc` functions to create temporary files with sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gtkdiskfree version 1.9.3 and earlier **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on the gtkdiskfree temporary file, potentially leading to data integrity violations. Additionally, there are multiple vulnerabilities in the gtkdiskfree package that can be exploited remotely, compromising the integrity of protected information. **Recommendations** For gtkdiskfree version 1.9.3 and earlier, consider restricting access to the `open cmd tube` function in mount.c until a patch is available. As a temporary workaround, avoid using the `open cmd tube` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CenterICQ versions 4.20.0 and earlier **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on the `gg.token.PID` temporary file. This is due to the creation of temporary files with predictable file names. **Recommendations** For versions 4.20.0 and earlier, consider restricting access to the temporary file directory to prevent symlink attacks until a patch is available. As a temporary workaround, avoid using the `gg.token.PID` temporary file or restrict its usage to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: xpvm version 1.2.5 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on the `xpvm.trace.$user` temporary file. This is related to the `xpvm.tcl` file in xpvm. Recommendations: For xpvm version 1.2.5, consider restricting access to the `xpvm.tcl` file to prevent local users from exploiting the symlink attack vulnerability on the `xpvm.trace.$user` temporary file. As a temporary workaround, avoid using the `xpvm.tcl` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ekg versions 2005-06-05 and earlier **Description** The issue allows local users to overwrite or create arbitrary files via a symlink attack on temporary files. This is related to the `linki.py` component in ekg. **Recommendations** For ekg versions 2005-06-05 and earlier, consider restricting access to the `linki.py` component until a fix is available. As a temporary workaround, avoid using `linki.py` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** xmysqladmin versions 1.0 and earlier **Description** The issue allows local users to delete arbitrary files via a symlink attack on a database backup file in /tmp. **Recommendations** For xmysqladmin versions 1.0 and earlier, consider restricting access to the database backup file in /tmp to prevent symlink attacks until a patch is available.

**Name of the Vulnerable Software and Affected Versions** LutelWall versions 0.97 and earlier **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to `wget`. This is a result of a symlink attack vulnerability. **Recommendations** For LutelWall versions 0.97 and earlier, as a temporary workaround, consider restricting access to the system call that utilizes `wget` until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** shtool versions 2.0.1 and earlier **Description** A race condition issue exists, allowing local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file. **Recommendations** For shtool versions 2.0.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gentoo webapp-config versions prior to 1.10-r14 **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file, specifically through the fn show postinst function. **Recommendations** For versions prior to 1.10-r14, update to version 1.10-r14 or later to resolve the issue. As a temporary workaround, consider restricting access to the fn show postinst function until a patch is available.