CVE-2013-2119

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/Patch, Vendor Advisory
http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1136.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=892813Issue Tracking, Third Party Advisory
http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/Patch, Vendor Advisory
http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1136.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=892813Issue Tracking, Third Party Advisory

Timeline

Published: Jan 3, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-21208.4The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate pa CVE-2013-21216.0Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users CVE-2013-21225.0The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated use CVE-2013-21235.8The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to con CVE-2013-21244.3Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a CVE-2013-21255.0OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blockin CVE-2013-21267.5Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attack CVE-2013-21277.5Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (cra CVE-2013-21285.5The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local CVE-2013-21294.3Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the CVE-2013-21304.0ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) e CVE-2013-21315.0Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial