CVE-2014-2893

LowCVSS 1.9/10Last modified Jun 17, 2026

Description

The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.

Metrics

CVSS 2.0 1.9/10AV:L/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2015-02/msg00038.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/04/16/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/04/20/1Mailing List, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817Issue Tracking, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00038.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/04/16/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/04/20/1Mailing List, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817Issue Tracking, Third Party Advisory

Timeline

Published: Apr 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-28947.2Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified CVE-2014-28969.8The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified CVE-2014-28979.8The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows re CVE-2014-28989.8wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers CVE-2014-28995.0wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer c CVE-2014-29005.8wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle a CVE-2014-29017.5wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.CVE-2014-29027.5wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.CVE-2014-29035.9CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server cert CVE-2014-29047.5wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.CVE-2014-29056.9fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the unive CVE-2014-29067.0The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute