Local Privilege Escalation in npm
Résumé
Local Privilege Escalation in npm
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write to, potentially resulting in local privilege escalation.
Recommendation
Update to version 1.3.3 or later.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2013-4116 npm Corrigé dans: 1.3.10~dfsg-1
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web bugs.debian.org
- web bugzilla.redhat.com
- web exchange.xforce.ibmcloud.com
- web npmjs.com
- web openwall.com
- web openwall.com
- web securityfocus.com