REDHAT-BUG-835076
First published: Mon Jun 25 2012(Updated: )
An insecure temporary directory use flaw was found in the way Rhythmbox, an integrated music management application based on the powerful GStreamer media framework, performed loading of HTML template files, used for rendering of 'Album', 'Lyrics', and 'Artist' tabs. Previously the '/tmp/context' directory has been searched as module directory when loading the HTML template files. A local attacker could use this flaw to conduct symbolic link attacks (possibly leading to attacker's ability to execute arbitrary HTML template file in the context of user running the rhythmbox executable). Upstream bug report: [1] <a href="https://bugzilla.gnome.org/show_bug.cgi?id=678661">https://bugzilla.gnome.org/show_bug.cgi?id=678661</a> References: [2] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rhythmbox |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.gnome.org/show_bug.cgi?id=678661
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673
- http://www.openwall.com/lists/oss-security/2012/06/25/5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=835080
- http://www.openwall.com/lists/oss-security/2012/06/25/7
- https://access.redhat.com/security/updates/classification/
- https://bugzilla.redhat.com/show_bug.cgi?id=835076
Frequently Asked Questions
What is the severity of REDHAT-BUG-835076?
REDHAT-BUG-835076 has been classified as a moderate security vulnerability due to insecure temporary directory usage.
How do I fix REDHAT-BUG-835076?
To fix REDHAT-BUG-835076, update Rhythmbox to the latest version that addresses the insecure temporary directory usage.
What systems are affected by REDHAT-BUG-835076?
The affected system for REDHAT-BUG-835076 is primarily the GNOME Rhythmbox application.
What type of vulnerability is REDHAT-BUG-835076?
REDHAT-BUG-835076 is categorized as an insecure temporary directory use flaw.
Can REDHAT-BUG-835076 lead to further attacks?
Yes, REDHAT-BUG-835076 could potentially allow unauthorized file access, leading to further attacks.
- collector/redhat-bugzilla
- alias/CVE-2012-3355
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/references
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnome
- canonical/rhythmbox