CVE-2014-1420
Low
Description
On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver would also open files without the O_EXCL flag. An attacker could exploit this to launch a symlink attack, though this is partially mitigated by symlink and hardlink restrictions in Ubuntu. Fixed in 1.1.1188+14.10.20140813.4-0ubuntu1.
SeverityLow
CVSS3.8
Exploit probability—
ProductCanonical Ubuntu-ui-toolkit
PublishedSep 11, 2020
First seenSep 11, 2020
Weakness typeCWE-59Improper link resolution
How to fix
Update
- canonical ubuntu-ui-toolkit1.1.1188\+14.10.20140813.4-0ubuntu1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canonical ubuntu-ui-toolkit | v < 1.1.1188\+14.10.20140813.4-0ubuntu1 | 1.1.1188\+14.10.20140813.4-0ubuntu1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.