| Name | CVE-2004-2097 |
| Description | Multiple scripts on SuSE Linux 9.0 allow local users to overwrite arbitrary files via a symlink attack on (1) /tmp/fvwm-bug created by fvwm-bug, (2) /tmp/wmmenu created by wm-oldmenu2new, (3) /tmp/rates created by x11perfcomp, (4) /tmp/xf86debug.1.log created by xf86debug, (5) /tmp/.winpopup-new created by winpopup-send.sh, or (6) /tmp/initrd created by lvmcreate_initrd. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| fvwm (PTS) | jessie | 1:2.6.5.ds-3 | fixed |
| stretch | 1:2.6.7-3 | fixed | |
| buster, bullseye | 1:2.6.8-1 | fixed | |
| bookworm | 1:2.7.0-2 | fixed | |
| sid, trixie | 1:2.7.0-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| fvwm | source | (unstable) | (not affected) | |||
| lvm10 | source | (unstable) | (not affected) | |||
| xbase-clients | source | (unstable) | (not affected) |
- fvwm <not-affected> (Used mktemp)
- xbase-clients <not-affected> (x11perfcomp uses mkdir atomically)
- lvm10 <not-affected> (does not contain lvmcreate_initrd)