CVE-2014-1624

Name	CVE-2014-1624
Description	Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	736247

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pyxdg (PTS)	bullseye	0.27-2	fixed
	bookworm, trixie	0.28-2	fixed
	forky, sid	0.28-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
pyxdg	source	squeeze	(not affected)
pyxdg	source	wheezy	(not affected)
pyxdg	source	(unstable)	0.25-4	low	736247

Notes

[squeeze] - pyxdg <not-affected> (get_runtime_dir introduced in later version)
[wheezy] - pyxdg <not-affected> (get_runtime_dir introduced in later version)