CVE-2010-1160

LowCVSS 1.9/10Last modified Jun 16, 2026

Description

GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim.

Metrics

CVSS 2.0 1.9/10AV:L/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-11613.7Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to CVE-2010-11627.2The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid func CVE-2010-11636.9The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has t CVE-2010-11644.3Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script CVE-2010-11659.0Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka at CVE-2010-11667.1The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a d CVE-2010-11674.3fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which a CVE-2010-11687.5The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo a CVE-2010-11698.5PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta bef CVE-2010-11706.0The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 b CVE-2010-11715.5Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arb CVE-2010-11723.6DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to bypass intended access restrictions an