| Package | Affected versions | Patched versions |
|---|---|---|
| org.scala-lang:scala-compiler | ≥ 2.11.0, < 2.11.12≥ 2.12.0, < 2.12.4< 2.10.7 | 2.11.122.12.42.10.7 |
| scala | ≥ 2.11.0, < 2.11.12≥ 2.12.0, < 2.12.4< 2.10.7 | 2.11.122.12.42.10.7 |
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free