Description

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Remediation

References

CVE-2013-4136

Related Vulnerabilities

MySQL CVE-2019-2632 Vulnerability (CVE-2019-2632)

Ampache Deserialization of Untrusted Data Vulnerability (CVE-2017-18375)

WordPress Plugin WPGlobus Translate Options Cross-Site Scripting (2.1.0)

Underscore.js Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-27601)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2016-9860)

Severity

Medium

Classification

CVE-2013-4136 CWE-59

Tags

Missing Update Known Vulnerabilities