CVE-2024-46062: Command Injection
Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46062?
The severity of CVE-2024-46062 is considered high due to its local privilege escalation potential.
How do I fix CVE-2024-46062?
To fix CVE-2024-46062, update to Miniconda3 version 23.11.0-1 or later.
Who is affected by CVE-2024-46062?
CVE-2024-46062 affects users who have installed Miniconda3 macOS installers prior to version 23.11.0-1 outside their home directory.
What type of vulnerability is CVE-2024-46062?
CVE-2024-46062 is a local privilege escalation vulnerability.
What causes the vulnerability in CVE-2024-46062?
The vulnerability in CVE-2024-46062 is caused by the creation of world-writable files during installation with root privileges.