4.4med
CVE-2008-2958
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via sy…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
4.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 21%
Public exploits
0
none known
Summary
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
Exploit prediction (EPSS)
0.28% probability of exploitation in the next 30 days, higher than 21% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
References
- secunia.com /advisories/30873 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- bugs.debian.org /cgi-bin/bugreport.cgi?bug=488140 · x_refsource_CONFIRM, x_transferred
- lists.alioth.debian.org /pipermail/secure-testing-team/2008-June/001672.html · x_refsource_MISC, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/43440 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2008-2958
- NVD: CVE-2008-2958
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.