CVE-2017-11746

Name	CVE-2017-11746
Description	Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script executes a "kill `cat /pathname/tenshi.pid`" command.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1069-1
Debian Bugs	871321

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tenshi (PTS)	buster	0.13-2.1	fixed
	bookworm, bullseye, sid, trixie	0.13-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
tenshi	source	wheezy	0.13-2+deb7u1		DLA-1069-1
tenshi	source	stretch	0.13-2.1~deb9u1
tenshi	source	(unstable)	0.13-2.1	unimportant		871321

Notes

https://github.com/inversepath/tenshi/issues/6
https://github.com/inversepath/tenshi/commit/d0e7f28c13ffbd5888b31d6532c2faf78f10f176
Negligible security impact