The docoredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.

Hugin was reported to create temporary / debug files in unsafe manner. During the optimizer run, it creates debug output file with pre-defined name: /tmp/hugindebugoptimresults.txt . If file was already created by other user, hugin gives an error message.

This problem can be abused by malicious local user to perform symlink attack against user running hugin, which will result in overwrite of arbitrary file writable by user running hugin with panorama optimizer output.

There does not seem to be any upstream patch at the moment. Updated package was released for openSuSE, which resolves this problem by disabling creation of debug file.