CVE-2016-8605: Medium severity red hat fedora vulnerability
The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8605?
CVE-2016-8605 is considered a medium severity vulnerability due to the potential for creating files with insecure permissions.
How do I fix CVE-2016-8605?
To mitigate CVE-2016-8605, update GNU Guile to version 2.0.12 or later, or ensure that umask is set correctly in your application.
What type of systems are affected by CVE-2016-8605?
CVE-2016-8605 affects GNU Guile versions up to 2.0.12 on Fedora operating systems versions 23, 24, and 25.
What kind of applications are vulnerable due to CVE-2016-8605?
Multithreaded applications using the mkdir procedure from GNU Guile can be vulnerable to CVE-2016-8605.
Can CVE-2016-8605 allow unauthorized access to files?
Yes, CVE-2016-8605 can potentially allow unauthorized access to files if they are created with overly permissive permissions.