CVE-2013-4392

Name	CVE-2013-4392
Description	systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low (attack range: local)
Debian Bugs	725357

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
systemd (PTS)	jessie	215-17+deb8u7	vulnerable
	jessie (security)	215-17+deb8u8	vulnerable
	stretch	232-25+deb9u6	vulnerable
	buster, sid	239-15	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
systemd	source	(unstable)	(unfixed)	unimportant		725357
systemd	source	wheezy	(not affected)

Notes

[wheezy] - systemd <not-affected> (/etc/tmpfiles.d not supported in Wheezy)
https://bugzilla.redhat.com/show_bug.cgi?id=859060
only relevant to systems running systemd along with selinux