CVE-2014-4038
Fixed in a distro release EPSS <1%
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.
Products: suse linux_enterprise_server, ppc64-diag_project ppc64-diag, redhat enterprise_linux_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ppc64-diag | 2.7.1-5 |
| Debian 14 | ppc64-diag | 2.7.1-5 |
| Red Hat Enterprise Linux 6 | ppc64-diag | 0:2.6.7-4.el6 |
| Red Hat Enterprise Linux 6 | ppc64-diag-debuginfo | 0:2.6.7-4.el6 |
| Red Hat Enterprise Linux 7 | ppc64-diag | 0:2.6.7-6.el7 |
| Red Hat Enterprise Linux 7 | ppc64-diag-debuginfo | 0:2.6.7-6.el7 |