CVE-2009-4135

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-11 · updated 2026-06-16
Weakness: CWE-59

Description

The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.

Affected products

Canonical Ubuntu Linux: 10.04, 12.04, 14.04
Fedoraproject Fedora: 11, 12
GNU coreutils: 5.2.1, 5.91, 5.92, 5.93, 5.94, 5.95 (+20)

References

http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5
http://marc.info/?l=oss-security&m=126030454503441&w=2
http://secunia.com/advisories/37645
http://secunia.com/advisories/37860
http://secunia.com/advisories/62226
http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18779.html
http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18787.html
http://www.openwall.com/lists/oss-security/2009/12/08/4
http://www.osvdb.org/60853
http://www.securityfocus.com/bid/37256
http://www.ubuntu.com/usn/USN-2473-1
http://www.vupen.com/english/advisories/2009/3453

Get alerted when CVE-2009-4135 or the next vulnerability affects your stack