« Volver al listado

CVE-2011-4328

Estado: ModificadaMedia (5)—

plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

GNU — Gnash

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-4328",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-06-16T00:55:05.357",
  "references": [
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649384",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://git.savannah.gnu.org/gitweb/?p=gnash.git%3Ba=commitdiff%3Bh=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2012-03/msg00003.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2012-03/msg00026.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/48325",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/48466",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2012/dsa-2435",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/11/21/12",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/11/21/7",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/77243",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/50747",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=755518",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649384",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://git.savannah.gnu.org/gitweb/?p=gnash.git%3Ba=commitdiff%3Bh=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2012-03/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2012-03/msg00026.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/48325",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/48466",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2012/dsa-2435",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/11/21/12",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/11/21/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/77243",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/50747",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=755518",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information."
    },
    {
      "lang": "es",
      "value": "En el archivo plugin/npapi/plugin.cpp en Gnash anterior a versión 0.8.10, utiliza permisos débiles (legibles en todo el mundo) para archivos de cookies con nombres predecibles en /tmp, lo que permite a los usuarios locales obtener información confidencial."
    }
  ],
  "lastModified": "2026-06-16T23:34:47.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:gnash:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05274F4A-C18C-4A79-8F5D-60C72342BB5C",
              "versionEndIncluding": "0.8.9"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnash:0.8.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FB00A25-37A0-46EE-9811-99946225D7C3"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnash:0.8.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CAADE3B-38A3-4663-AAC5-4D3EB885DE5A"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnash:0.8.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74D91B3F-C6EF-4E46-929D-E3D02D93808A"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnash:0.8.9:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39CCB5F6-1871-42FF-9E75-BAB6108CACC1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}