Description

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.

Remediation

References

CVE-2014-1832

Related Vulnerabilities

Oracle Database Server CVE-2006-0263 Vulnerability (CVE-2006-0263)

Ruby Double Free Vulnerability (CVE-2022-28738)

OpenSSL Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2015-3216)

WordPress Plugin YOP Poll Cross-Site Scripting (6.2.7)

WordPress Plugin MPL-Publisher-Create your Ebook & Audiobook Cross-Site Scripting (1.29.1)

Severity

Low

Classification

CVE-2014-1832

Tags

Missing Update Known Vulnerabilities