CVE-2014-1639

LOW 3.3CVE-2014-1639 · Published 28/01/2014 · updated 17/06/2026

In short

CVE-2014-1639 is a LOW (CVSS 3.3) vulnerability affecting syncevolution (debian).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 29.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
syncevolution debian	`≤ 1.3.99.6`	No fix yet

Description

syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.

References

bugs.debian.org/cgi-bin/bugreport.cgi · Vendor Advisory
openwall.com/lists/oss-security/2014/01/22/3
openwall.com/lists/oss-security/2014/01/22/4
osvdb.org/102380
securityfocus.com/bid/65098
exchange.xforce.ibmcloud.com/vulnerabilities/90662

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free