CVE-2012-3355: Code Injection

First published: Mon Jun 25 2012(Updated: )

An insecure temporary directory use flaw was found in the way Rhythmbox, an integrated music management application based on the powerful GStreamer media framework, performed loading of HTML template files, used for rendering of 'Album', 'Lyrics', and 'Artist' tabs. Previously the '/tmp/context' directory has been searched as module directory when loading the HTML template files. A local attacker could use this flaw to conduct symbolic link attacks (possibly leading to attacker's ability to execute arbitrary HTML template file in the context of user running the rhythmbox executable). Upstream bug report: [1] <a href="https://bugzilla.gnome.org/show_bug.cgi?id=678661">https://bugzilla.gnome.org/show_bug.cgi?id=678661</a> References: [2] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/author
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/type
• agent/weakness
• collector/nvd-index
• collector/redhat-bugzilla
• alias/CVE-2012-3355
• vendor/gnome
• canonical/gnome rhythmbox
• version/gnome rhythmbox/0.13.3
• version/gnome rhythmbox/0.5.0
• version/gnome rhythmbox/0.5.1
• version/gnome rhythmbox/0.5.2
• version/gnome rhythmbox/0.5.3
• version/gnome rhythmbox/0.5.4
• version/gnome rhythmbox/0.5.88
• version/gnome rhythmbox/0.6.0
• version/gnome rhythmbox/0.6.1
• version/gnome rhythmbox/0.6.2
• version/gnome rhythmbox/0.6.3
• version/gnome rhythmbox/0.6.4
• version/gnome rhythmbox/0.6.5
• version/gnome rhythmbox/0.6.6
• version/gnome rhythmbox/0.6.7
• version/gnome rhythmbox/0.6.8
• version/gnome rhythmbox/0.7.0
• version/gnome rhythmbox/0.7.1
• version/gnome rhythmbox/0.7.2
• version/gnome rhythmbox/0.8.0
• version/gnome rhythmbox/0.8.1
• version/gnome rhythmbox/0.8.2
• version/gnome rhythmbox/0.8.3
• version/gnome rhythmbox/0.8.4
• version/gnome rhythmbox/0.8.5
• version/gnome rhythmbox/0.8.6
• version/gnome rhythmbox/0.8.7
• version/gnome rhythmbox/0.8.8
• version/gnome rhythmbox/0.9.0
• version/gnome rhythmbox/0.9.1
• version/gnome rhythmbox/0.9.2
• version/gnome rhythmbox/0.9.3
• version/gnome rhythmbox/0.9.3.1
• version/gnome rhythmbox/0.9.4
• version/gnome rhythmbox/0.9.4.1
• version/gnome rhythmbox/0.9.5
• version/gnome rhythmbox/0.9.6
• version/gnome rhythmbox/0.9.6.90
• version/gnome rhythmbox/0.9.7
• version/gnome rhythmbox/0.9.8
• version/gnome rhythmbox/0.10.0
• version/gnome rhythmbox/0.10.0.90
• version/gnome rhythmbox/0.10.1
• version/gnome rhythmbox/0.11.0
• version/gnome rhythmbox/0.11.1
• version/gnome rhythmbox/0.11.2
• version/gnome rhythmbox/0.11.3
• version/gnome rhythmbox/0.11.4
• version/gnome rhythmbox/0.11.5
• version/gnome rhythmbox/0.11.6
• version/gnome rhythmbox/0.12.0
• version/gnome rhythmbox/0.12.1
• version/gnome rhythmbox/0.12.2
• version/gnome rhythmbox/0.12.3
• version/gnome rhythmbox/0.12.4
• version/gnome rhythmbox/0.12.5
• version/gnome rhythmbox/0.12.6
• version/gnome rhythmbox/0.12.7
• version/gnome rhythmbox/0.12.8
• version/gnome rhythmbox/0.13.0
• version/gnome rhythmbox/0.13.1
• version/gnome rhythmbox/0.13.2