Home > Vulnerability Database > CVE-2011-4328

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2011-4328

Date: June 15, 2012

plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.

Language: C++

Severity Score

5.3

Related Resources (15)

Url: http://git.savannah.gnu.org/gitweb/?p=gnash.git%3Ba=commitdiff%3Bh=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55

Url: http://lists.opensuse.org/opensuse-updates/2012-03/msg00026.html

Url: http://www.debian.org/security/2012/dsa-2435

Url: https://bugzilla.redhat.com/show_bug.cgi?id=755518

Url: http://www.openwall.com/lists/oss-security/2011/11/21/12

Url: http://www.osvdb.org/77243

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-4328

Url: http://lists.opensuse.org/opensuse-updates/2012-03/msg00003.html

Url: http://www.openwall.com/lists/oss-security/2011/11/21/7

Url: http://secunia.com/advisories/48466

Url: http://secunia.com/advisories/48325

Url: http://www.securityfocus.com/bid/50747

Url: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649384

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2011-4328

Url: https://www.mend.io/vulnerability-database/CVE-2011-4328

Severity Score

5.3

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us