CVE-2004-1167

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

mirrorselect before 0.89 creates temporary files in a world-writable location with predictable file names, which allows remote attackers to overwrite arbitrary files via a symlink attack.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-116810.0Stack-based buffer overflow in the WebDav handler in MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to execute arbitrary code CVE-2004-11695.0MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to cause a denial of service (application crash) via an HTTP GET request for a CVE-2004-117010.0a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.CVE-2004-11712.1KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handCVE-2004-117210.0Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40, aCVE-2004-11737.5Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Dynamic HTMCVE-2004-11745.0direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file haCVE-2004-11757.5fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metCVE-2004-11767.5Buffer underflow in extfs.c in Midnight Commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service and possibly CVE-2004-11774.3Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web scriptCVE-2004-11792.1The debstd script in debmake 3.6.x before 3.6.10 and 3.7.x before 3.7.7 allows local users to overwrite arbitrary files via a symlink attackCVE-2004-11805.0Unknown vulnerability in the rwho daemon (rwhod) before 0.17, on little endian architectures, allows remote attackers to cause a denial of s
CVE-2004-1167: Medium severity, CVSS 5.0 | Vulnix