CoreCVE
Back

MEDIUM

deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix() function to download an ISO file, and follows symlinks there

Published Jul 4, 2019

Description

deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix() function to download an ISO file, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled. By winning a race condition to replace the /tmp/repo.iso symlink by an attacker controlled ISO file, further privilege escalation may be possible.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-59

References (5)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner mitre
Published Jul 4, 2019
Updated Aug 4, 2024
Reserved Jul 4, 2019
Link CVE-2019-13228

CISA Vulnrichment

No data

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2019-13228

Red Hat

No data

ENISA EUVD

Assigner mitre
Published Jul 4, 2019
Updated Aug 4, 2024
Link EUVD-2019-4741

GitHub

No data