VDB
CVE-2012-3355
CVE-2012-3355
PUBLISHED
CVSS 3.5999999046325684 LOW
(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.
EPSS 0.57% · 46.1th percentile
Risk Scores
CVSS 2.0
3.5999999046325684
EPSS Score
0.57%
46.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| gnome | rhythmbox | 0.5.1, 0.5.2, 0.5.3 |
Timeline
- Jul 17, 2012 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 17, 2022 CVE Updated
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 24, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 10, 2023 EPSS Score
References
- [oss-security] 20120625 Re: CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Album', 'Lyrics', and 'Artist' tabs mailing-list
- http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-3355.html url
- https://bugzilla.redhat.com/show_bug.cgi?id=835076 url
- http://www.ubuntu.com/usn/USN-1503-1 technical
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673 technical
- http://www.securityfocus.com/bid/54186 technical
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76538 technical
- https://nvd.nist.gov/vuln/detail/CVE-2012-3355 advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=678661 url
- https://hermes.opensuse.org/messages/15351848 url
- http://www.openwall.com/lists/oss-security/2012/06/25/5 url