CVE-2012-3378

The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.3 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:N/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
VendorProductVersion
gnomeat-spi2-atk
2.5.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
at-spi2-atk
bullseye
2.38.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
at-spi2-atk
zesty
not-affected
yakkety
not-affected
xenial
not-affected
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
ignored
oneiric
ignored
natty
ignored
lucid
dne
hardy
dne
Common Weakness Enumeration
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678026
http://www.openwall.com/lists/oss-security/2012/07/05/1
http://www.openwall.com/lists/oss-security/2012/07/06/3
https://bugzilla.gnome.org/show_bug.cgi?id=678348
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678026
http://www.openwall.com/lists/oss-security/2012/07/05/1
http://www.openwall.com/lists/oss-security/2012/07/06/3
https://bugzilla.gnome.org/show_bug.cgi?id=678348