The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pyxdg | Jul 30, 2024 | Jan 28, 2014 |
| Oracle Solaris | — | Upgrade library/python/python-xdg-27 to version 0.25-0.175.3.16.0.2.0 on Solaris 11.3 | May 29, 2017 | Jan 27, 2014 |
| Suse | — | Upgrade python-xdg | Oct 19, 2019 | Jan 27, 2014 |
| Ubuntu | — | Upgrade pyxdg | Nov 19, 2024 | Jan 28, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub