CVE-2014-1402

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

Metrics

CVSS 2.0 4.4/10AV:L/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-14034.3Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTM CVE-2014-14055.8Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect use CVE-2014-14064.3CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attacke CVE-2014-14074.3Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to CVE-2014-14087.8The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for CVE-2014-14099.1MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with CVE-2014-14186.4Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cac CVE-2014-14196.9Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecif CVE-2014-14203.3On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive da CVE-2014-14217.2mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass CVE-2014-14225.0In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because t CVE-2014-14235.5signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due