CVE-2015-0858

NameCVE-2015-0858
DescriptionCool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-564-1, DSA-3562-1
NVD severitylow

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tardiff (PTS)jessie (security), jessie0.1-2+deb8u2fixed
buster, stretch0.1-5fixed
bullseye, sid0.1-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tardiffsource(unstable)0.1-3
tardiffsourcejessie0.1-2+deb8u2DSA-3562-1
tardiffsourcewheezy0.1-1+deb7u1DLA-564-1

Notes

https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a

Search for package or bug name: Reporting problems