CVE-2014-3431

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-06-21 · updated 2026-06-17
Weakness: CWE-264

Description

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors.

Affected products

Symantec Corporation Symantec Encryption Desktop: 10.3.0, 10.3.1, 10.3.2, 10.3.2-mp1
Symantec Pgp Desktop: 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.1.0, 10.1.1 (+4)

References

http://secunia.com/advisories/59421
http://www.securityfocus.com/bid/68077
http://www.securitytracker.com/id/1030454
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140620_00
http://secunia.com/advisories/59421
http://www.securityfocus.com/bid/68077
http://www.securitytracker.com/id/1030454
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140620_00

Get alerted when CVE-2014-3431 or the next vulnerability affects your stack