Ppc64-Diag Project Ppc64-Diag vulnerabilities
2 known vulnerabilities affecting ppc64-diag_project/ppc64-diag.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM1LOW1
Vulnerabilities
Page 1 of 1
CVE-2014-4038P4MEDIUMCVSS 4.4v2.6.12014-06-17
CVE-2014-4038 [MEDIUM] CWE-59 CVE-2014-4038: ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1)
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.
nvdosv
CVE-2014-4039P4LOWCVSS 2.1v2.6.12014-06-17
CVE-2014-4039 [LOW] CWE-264 CVE-2014-4039: ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permission
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.
nvdosv