CVE-2012-1906

LowCVSS 3.3/10Last modified Jun 16, 2026

Description

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Metrics

CVSS 2.0 3.3/10AV:L/AC:M/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://projects.puppetlabs.com/issues/13260Vendor Advisory
http://puppetlabs.com/security/cve/cve-2012-1906/Vendor Advisory
http://secunia.com/advisories/48743Vendor Advisory
http://secunia.com/advisories/48748Vendor Advisory
http://secunia.com/advisories/48789Vendor Advisory
http://ubuntu.com/usn/usn-1419-1
http://www.debian.org/security/2012/dsa-2451
http://www.securityfocus.com/bid/52975
https://exchange.xforce.ibmcloud.com/vulnerabilities/74793
http://projects.puppetlabs.com/issues/13260Vendor Advisory
http://puppetlabs.com/security/cve/cve-2012-1906/Vendor Advisory
http://secunia.com/advisories/48743Vendor Advisory
http://secunia.com/advisories/48748Vendor Advisory
http://secunia.com/advisories/48789Vendor Advisory
http://ubuntu.com/usn/usn-1419-1
http://www.debian.org/security/2012/dsa-2451
http://www.securityfocus.com/bid/52975
https://exchange.xforce.ibmcloud.com/vulnerabilities/74793

Timeline

Published: May 29, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-19074.3The scanner engine in PrivaWall Antivirus 5.6 and earlier does not recognize the Office XML (aka Open Document XML) file format, which allow CVE-2012-19084.3Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.3 allows remote attackers to inject arbitrary web script or HTML via unknow CVE-2012-19095.0The Bitcoin protocol, as used in bitcoind before 0.4.4, wxBitcoin, Bitcoin-Qt, and other programs, does not properly handle multiple transac CVE-2012-19107.5Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW mul CVE-2012-19117.5Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrary SQL commands via t CVE-2012-19124.3Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers to inject arbitrary CVE-2012-19156.1EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.CVE-2012-19167.5@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an ex CVE-2012-19175.0compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique p CVE-2012-19185.0Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Sourc CVE-2012-19196.4CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct direct CVE-2012-19205.0@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request