Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
1.2

devscripts script can let a local user change any file

CVE-2012-3500 · published 14 years ago
Summary

The annotate-output.sh script that comes with older versions of devscripts (and rpmdevtools) can be tricked by a user on the same system into overwriting files they shouldn't. This happens because the script creates temporary files that can be redirected via symbolic links. Updating to the latest versions of devscripts and rpmdevtools will fix the issue.

What to do
  • Update debian devscripts to version 2.12.2.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian devscripts < 2.12.2
Fix: upgrade to 2.12.2
Debian:13 debian devscripts < 2.12.2
Fix: upgrade to 2.12.2
Debian:14 debian devscripts < 2.12.2
Fix: upgrade to 2.12.2
– devscripts_devel_team devscripts <= 2.12.1
2.12.0
cpe:2.3:a:devscripts_devel_team:devscripts:*:*:*:*:*:*:*:*
Original advisory text
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or ...
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
References
Severity
1.2 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published1 Oct 2012
Updated3 Nov 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-3500 · OSV
CVE-2012-3500 · NVD
Track software like this
Free during beta