CVE-2014-2893: Low severity openSUSE openSUSE vulnerability
Jakub Wilk discovered that clang's scan-build utility insecurely handled temporary files. A local attacker could use this flaw to perform a symbolic link attack against users running the scan-build utility.
Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817
Other sources
The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.
— Debian
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2893?
CVE-2014-2893 is considered a security vulnerability that can lead to local denial of service or unauthorized access due to improper handling of temporary files.
How do I fix CVE-2014-2893?
To mitigate CVE-2014-2893, update clang and llvm-toolchain to versions that are not affected by this vulnerability.
What type of attack is possible with CVE-2014-2893?
CVE-2014-2893 allows local attackers to perform symbolic link attacks against users running the scan-build utility.
Which software packages are affected by CVE-2014-2893?
CVE-2014-2893 affects clang versions up to 3.5 and the llvm-toolchain-3.3 in Debian and openSUSE 13.1.
Who discovered CVE-2014-2893?
CVE-2014-2893 was discovered by researcher Jakub Wilk.