The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpngUpgrade automake. | Aug 30, 2017 | Aug 7, 2012 |
| Centos_linux | — | Upgrade automake | Dec 1, 2016 | Aug 7, 2012 |
| Debian | — | Upgrade automake1.11 | Jul 30, 2024 | Aug 7, 2012 |
| Freebsd | — | Upgrade automake | Dec 10, 2025 | Aug 6, 2012 |
| Gentoo Linux | — | Upgrade sys-devel/automake. | Oct 30, 2017 | Aug 7, 2012 |
| Oracle_linux | — | Upgrade automake | Oct 16, 2024 | Aug 7, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 9, 2012 |
| Suse | — | Upgrade gvUpgrade libpng15-15Upgrade wdiffUpgrade libpng12-develUpgrade automakeUpgrade libpng12-compat-develUpgrade libpng12-0-32bitUpgrade wdiff-langUpgrade libpng12-0 | Dec 12, 2013 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub