CVE-2014-1858 (MEDIUM 5.5) · Watchpost

← All vulnerabilities

Arbitrary file write in NumPy

MEDIUM 5.5CVE-2014-1858 · GHSA-cw6w-4rcx-xphc · PYSEC-2018-33 · Published 08/01/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
numpy PyPI	`< 1.8.1`	`1.8.1`
numpy numpy	`< 1.8.1`	`1.8.1`

Description

init.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.

NVD description

__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.

References

nvd.nist.gov/vuln/detail/CVE-2014-1858 · ADVISORY
numpy/numpy#4262 · WEB
numpy/numpy commit 0bb46c1 · WEB
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/91318 · WEB
GitHub Advisory GHSA-cw6w-4rcx-xphc · ADVISORY
numpy/numpy · PACKAGE
numpy/numpy · WEB
pypa/advisory-database · WEB
lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html · WEB
openwall.com/lists/oss-security/2014/02/08/3 · WEB
securityfocus.com/bid/65441 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free