CVE-2012-3355: Code Injection
(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.
Other sources
An insecure temporary directory use flaw was found in the way Rhythmbox, an integrated music management application based on the powerful GStreamer media framework, performed loading of HTML template files, used for rendering of 'Album', 'Lyrics', and 'Artist' tabs. Previously the '/tmp/context' directory has been searched as module directory when loading the HTML template files. A local attacker could use this flaw to conduct symbolic link attacks (possibly leading to attacker's ability to execute arbitrary HTML template file in the context of user running the rhythmbox executable).
Upstream bug report: [1] https://bugzilla.gnome.org/showbug.cgi?id=678661
References: [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3355?
CVE-2012-3355 has been rated as moderate, indicating it may allow local users to gain privileges.
How does CVE-2012-3355 affect Rhythmbox?
CVE-2012-3355 affects Rhythmbox by using insecure temporary directories, which could lead to the execution of arbitrary code when processing HTML templates.
What versions of Rhythmbox are affected by CVE-2012-3355?
CVE-2012-3355 affects all versions of Rhythmbox up to and including version 0.13.3.
How can I fix CVE-2012-3355?
To mitigate CVE-2012-3355, update Rhythmbox to a version newer than 0.13.3 or follow the recommended security updates from your distribution.
Is there any known exploit for CVE-2012-3355?
While there are no public exploits specifically targeting CVE-2012-3355, the vulnerability poses a risk due to improper handling of temporary directories.