CVE-2013-2027

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://advisories.mageia.org/MGASA-2015-0096.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00055.htmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:158Broken Link
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
https://bugzilla.redhat.com/show_bug.cgi?id=947949Issue Tracking
http://advisories.mageia.org/MGASA-2015-0096.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00055.htmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:158Broken Link
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
https://bugzilla.redhat.com/show_bug.cgi?id=947949Issue Tracking

Timeline

Published: Feb 13, 2015
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20287.5The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of servi CVE-2013-20296.3nagios.upgrade_to_v3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to over CVE-2013-20302.1keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing cer CVE-2013-20314.3MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CVE-2013-20325.0MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordRe CVE-2013-20332.1Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x b CVE-2013-20346.8Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.CVE-2013-20354.4Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library pat CVE-2013-20364.3Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbit CVE-2013-20372.6httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the CVE-2013-20384.3The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitr CVE-2013-20394.0Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenti