CVE-2016-3992

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp.

Metrics

CVSS 3.0 6.2/10CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2016-07/msg00013.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/04/09/4
http://www.openwall.com/lists/oss-security/2016/04/10/2
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-07/msg00013.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/04/09/4
http://www.openwall.com/lists/oss-security/2016/04/10/2
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331Third Party Advisory

Timeline

Published: Jul 26, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-39937.5Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of se CVE-2016-39948.2The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive informati CVE-2016-39957.5The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.CVE-2016-39965.5ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data vi CVE-2016-39977.5NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of servic CVE-2016-39988.1NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of s CVE-2016-39996.1Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri CVE-2016-40009.8Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.CVE-2016-40018.6Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configu CVE-2016-40029.8Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allow CVE-2016-40036.1Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when usin CVE-2016-40044.9Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbi