CVE-2007-5751

Name	CVE-2007-5751
Description	Liferea before 1.4.6 uses weak permissions (0644) for the feedlist.opml backup file, which allows local users to obtain credentials.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DTSA-107-1
Debian Bugs	448850

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
liferea (PTS)	jessie	1.10.12-1	fixed
	stretch	1.12~rc3-1	fixed
	buster	1.12.6-1+deb10u1	fixed
	bullseye	1.13.5-3	fixed
	bookworm	1.14.4-3	fixed
	sid, trixie	1.15.8-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
liferea	source	sarge	(not affected)
liferea	source	etch	(not affected)
liferea	source	lenny	1.0.27-2+lenny1		DTSA-107-1
liferea	source	(unstable)	1.4.6-1	low		448850

Notes

[etch] - liferea <not-affected> (backup feedlist introduced in 1.2.7)
[sarge] - liferea <not-affected> (backup feedlist introduced in 1.2.7)
this file can contain credentials for rss feeds