CVEvulnerability
CVE-2015-3436
6.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-06-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.6 MEDIUM — AV:L/AC:L/Au:N/C:N/I:C/A:C
- Weaknesses
- CWE-59
Description
provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.
Affected configurations
• zarafa zarafa collaboration platform (<= 7.1.12)
• zarafa zarafa collaboration platform 7.2.0
Related
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159455.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159497.html lists.fedoraproject.org
- http://www.securityfocus.com/bid/75104 www.securityfocus.com
- https://jira.zarafa.com/browse/ZCP-13282 jira.zarafa.com
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159455.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159497.html lists.fedoraproject.org
- http://www.securityfocus.com/bid/75104 www.securityfocus.com
- https://jira.zarafa.com/browse/ZCP-13282 jira.zarafa.com