Fluid Attacks Database

Description

Virtualenv Allows Symlink Attack on /tmp/ virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	virtualenv	>=0 <1.5	1.5
debian 11	python-virtualenv	>=0 <1.6-1	1.6-1
debian 12	python-virtualenv	>=0 <1.6-1	1.6-1
debian 13	python-virtualenv	>=0 <1.6-1	1.6-1
debian 14	python-virtualenv	>=0 <1.6-1	1.6-1

Aliases

1. CVE-2011-46172. NVD-2011-46173. OSV-2011-46174. OSV-DEBIAN-2011-46175. GCVE-2011-46176. SECURITY-TRACKER-CVE-2011-4617

References

1. https://github.com/pypa/virtualenv/commit/68075ad9ededf7df2c46d385f836c13b729de2ca2. https://bitbucket.org/ianb/virtualenv/changeset/8be37c509fe53. https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2011-23.yaml4. https://web.archive.org/web/20200228151935/https://bitbucket.org/ianb/virtualenv/commits/8be37c509fe55. http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071638.html6. http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071643.html7. http://openwall.com/lists/oss-security/2011/12/19/28. http://openwall.com/lists/oss-security/2011/12/19/49. http://openwall.com/lists/oss-security/2011/12/19/5

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.