GitHub Advisoryadvisory · PyPI

GHSA-2fc2-6r4j-p65h Numpy arbitrary file write via symlink attack

HIGH Published 2022-05-14 Modified 2024-10-01 Official page ↗
Aliases
CVE-2014-1859
Ecosystem
PyPI
Packages
numpy
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2022-06-17

Affected packages

• PyPI numpy: < 1.8.1 → fixed in 1.8.1

Description

(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.

Related

Alias · CVE (1)

  • CVE-2014-1859 (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References