Local Privilege Escalation in npm
Summary
Local Privilege Escalation in npm
Original description
The description as published by the source.
Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write to, potentially resulting in local privilege escalation.
Recommendation
Update to version 1.3.3 or later.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2013-4116 npm Fixed in: 1.3.10~dfsg-1
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web bugs.debian.org
- web bugzilla.redhat.com
- web exchange.xforce.ibmcloud.com
- web npmjs.com
- web openwall.com
- web openwall.com
- web securityfocus.com