The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle Solaris | — | Upgrade library/readline to version 7.0-11.4.7.0.1.2.0 on Solaris 11.4 | Mar 20, 2019 | Aug 20, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 14, 2014 |
| Suse | — | Upgrade libreadline7Upgrade bashUpgrade readline-docUpgrade bash-develUpgrade crash-kmp-defaultUpgrade bash-docUpgrade bash-langUpgrade crash-kmp-64kbUpgrade libreadline6Upgrade readline-develUpgrade libreadline6-32bitUpgrade crashUpgrade crash-devel | Dec 18, 2015 | Aug 20, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub