REDHAT-BUG-835076: Low severity Gnome Rhythmbox vulnerability

Published Jun 25, 2012

Updated

An insecure temporary directory use flaw was found in the way Rhythmbox, an integrated music management application based on the powerful GStreamer media framework, performed loading of HTML template files, used for rendering of 'Album', 'Lyrics', and 'Artist' tabs. Previously the '/tmp/context' directory has been searched as module directory when loading the HTML template files. A local attacker could use this flaw to conduct symbolic link attacks (possibly leading to attacker's ability to execute arbitrary HTML template file in the context of user running the rhythmbox executable).

Upstream bug report: [1] https://bugzilla.gnome.org/showbug.cgi?id=678661

References: [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673

Affected Software

1 affected component

Gnome Rhythmbox

Event History

Jun 25, 2012

Data Sourced

01:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-835076?

REDHAT-BUG-835076 has been classified as a moderate security vulnerability due to insecure temporary directory usage.

How do I fix REDHAT-BUG-835076?

To fix REDHAT-BUG-835076, update Rhythmbox to the latest version that addresses the insecure temporary directory usage.

What systems are affected by REDHAT-BUG-835076?

The affected system for REDHAT-BUG-835076 is primarily the GNOME Rhythmbox application.

What type of vulnerability is REDHAT-BUG-835076?

REDHAT-BUG-835076 is categorized as an insecure temporary directory use flaw.

Can REDHAT-BUG-835076 lead to further attacks?

Yes, REDHAT-BUG-835076 could potentially allow unauthorized file access, leading to further attacks.