Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

semi library lets local user replace any file

CVE-2003-0440 · published 23 years ago
Summary

The semi MIME library up to version 1.14.5 (and wemi up to 1.14.0) can be tricked by a local user into overwriting any file on the system through a symbolic‑link trick on temporary files. This could let an attacker modify important data or install malicious code. Update to the latest library versions and ensure only trusted users have local access to the system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
semi semi 1.14.3
cpe:2.3:a:semi:semi:1.14.3:*:*:*:*:*:*:*
debian debian_linux 3.0
cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*
Original advisory text
The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published18 Aug 2003
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2003-0440 · NVD
Track software like this
Free during beta