Red Hat Bugzilla – Bug 1048678
CVE-2014-0027 flite: insecure temporary file use
Last modified: 2015-10-15 14:09:57 EDT
It was found that flite, a speech synthesis engine (text-to-speech), insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running flite, or possibly obtain sensitive information as the temporary file may contain text-to-speech output (screen contents).
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Created attachment 846118 [details]
Created flite tracking bugs for this issue:
Affects: fedora-all [bug 1050997]
Affects: epel-all [bug 1050998]
This issue affects the version of flite package as shipped with Fedora 19 and Fedora 20.
This issue affects the version of flite package as shipped with epel-5 and epel-6.
flite-1.3-20.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
flite-1.3-21.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.