CVE-2014-1934: Medium severity Travis Shirk Eyed3 vulnerability
Jakub Wilk discovered two instances in tag.py where temporary files were created insecurely via mktemp(). A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file.
Further details are available in the original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737062
Other sources
tag.py in eyeD3 (aka python-eyed3) 0.7.5 and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1934?
CVE-2014-1934 has a medium severity rating as it allows local attackers to exploit symbolic link attacks.
How do I fix CVE-2014-1934?
To fix CVE-2014-1934, upgrade to a patched version of the affected software beyond 0.7.5 for eyeD3 or 0.8.10-4 and 0.9.7-1 for eyed3.
Which versions are affected by CVE-2014-1934?
CVE-2014-1934 affects versions of eyeD3 prior to 0.7.5 and versions of eyed3 before 0.8.10-4 and 0.9.7-1.
Who discovered CVE-2014-1934?
CVE-2014-1934 was discovered by Jakub Wilk, highlighting insecure file creation using mktemp().
What type of attack can CVE-2014-1934 enable?
CVE-2014-1934 can enable symbolic link attacks allowing local attackers to modify arbitrary files.