Ubuntu 12.04 LTS : xdiagnose update (USN-1591-1)

Ubuntu Security Notice (C) 2012-2014 Canonical, Inc. / NASL script (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

Alec Warner discovered that xdiagnose improperly handled temporary
files in welcome.py when creating user-initiated archive files. While
failsafeX does not use the vulnerable code, this update removes this
functionality to protect any 3rd party applications which import the
vulnerable code. In the default Ubuntu installation, this should be
prevented by the Yama link restrictions.

Solution :

Update the affected xdiagnose package.

Risk factor :

Low / CVSS Base Score : 3.3
(CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:P)
CVSS Temporal Score : 2.7
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 62409 ()

Bugtraq ID: 55912

CVE ID: