CVE-2012-5630

MediumCVSS 6.3/10Last modified Jun 16, 2026

Description

libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
libuser	libuser	0.57; 0.56

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102068.htmlThird Party Advisory
https://access.redhat.com/security/cve/cve-2012-5630Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5630Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5630Third Party Advisory
https://www.securityfocus.com/bid/59285Third Party Advisory, VDB Entry
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102068.htmlThird Party Advisory
https://access.redhat.com/security/cve/cve-2012-5630Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5630Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5630Third Party Advisory
https://www.securityfocus.com/bid/59285Third Party Advisory, VDB Entry

Timeline

Published: Nov 25, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56318.8ipa 3.0 does not properly check server identity before sending credential containing cookies CVE-2012-56335.8The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasse CVE-2012-56346.1Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behi CVE-2012-56352.1The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitra CVE-2012-56366.1Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote CVE-2012-56383.6The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwri CVE-2012-56396.5LibreOffice and OpenOffice automatically open embedded content CVE-2012-56405.5thttpd has a local DoS vulnerability via specially-crafted .htpasswd files CVE-2012-56415.0Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before CVE-2012-56427.5server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to tri CVE-2012-56435.0Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 CVE-2012-56445.5libuser has information disclosure when moving user's home directory