CVE-2019-18192 - GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365

Back Back to CVE browser

HIGH

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365

Published Oct 17, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.34%

Description

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (3)

http://www.openwall.com/lists/oss-security/2019/10/17/3
mailing-listx_refsource_MLISTMailing ListPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7995
Advisory
https://issues.guix.gnu.org/issue/37744
x_refsource_MISCExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/10/17/3		mailing-listx_refsource_MLISTMailing ListPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7995		Advisory
https://issues.guix.gnu.org/issue/37744		x_refsource_MISCExploitIssue TrackingThird Party Advisory