Description

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Remediation

References

CVE-2013-4136

Related Vulnerabilities

WordPress Plugin Events Manager CSV Injection (5.9.7.1)

Oracle HTTP Server Other Vulnerability (CVE-1999-1125)

Nginx Improper Certificate Validation Vulnerability (CVE-2009-3555)

WordPress Plugin Google Maps Ready! Cross-Site Request Forgery (1.1.5)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-10704)

Severity

Medium

Classification

CVE-2013-4136 CWE-59

Tags

Missing Update Known Vulnerabilities