CVE-2017-18284

Name	CVE-2017-18284
Description	The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
burp (PTS)	bullseye	2.2.18-8	fixed
	bookworm	3.1.4-1	fixed
	forky, sid, trixie	3.1.4-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
burp	source	(unstable)	(not affected)

- burp <not-affected> (Debian package uses /var/run for the PID file)