Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1088105 - (CVE-2014-2893) CVE-2014-2893 llvm: insecure temporary file handling in clang's scan-build utility
CVE-2014-2893 llvm: insecure temporary file handling in clang's scan-build ut...
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20140415,reported=2...
: Security
Depends On: 1088107 1088108
Blocks:
  Show dependency tree / graph
 
Reported: 2014-04-16 00:21 EDT by Murray McAllister
Modified: 2015-03-03 05:17 EST (History)
11 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-01-29 22:47:39 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Murray McAllister 2014-04-16 00:21:35 EDT 
Jakub Wilk discovered that clang's scan-build utility insecurely handled temporary files. A local attacker could use this flaw to perform a symbolic link attack against users running the scan-build utility.

Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817
Comment 1 Murray McAllister 2014-04-16 00:23:12 EDT 
This issue affects the llvm package in Fedora and EPEL. python-llvmpy and mingw-llvm are not affected.
Comment 2 Murray McAllister 2014-04-16 00:24:19 EDT 
Created llvm tracking bugs for this issue:

Affects: fedora-all [bug 1088107]
Affects: epel-6 [bug 1088108]
Comment 3 Murray McAllister 2014-04-16 00:28:04 EDT 
CVE request: http://www.openwall.com/lists/oss-security/2014/04/16/2
Comment 4 Murray McAllister 2014-04-22 01:22:34 EDT 
MITRE assigned CVE-2014-2893 to this issue:

http://seclists.org/oss-sec/2014/q2/144
Comment 6 Fedora Update System 2014-12-21 12:43:22 EST 
llvm-3.4.2-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2014-12-21 12:43:47 EST 
llvm-3.4.2-3.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.