{"id":"CVE-2013-4136","published":"2013-09-30T19:00:00Z","modified":"2024-09-17T03:38:39Z","title":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or…","vendor":null,"product":null,"tier":"tail","description":{"text":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00326,"percentile":0.25647,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/phusion/passenger/blob/release-4.0.6/NEWS","tags":["x_refsource_CONFIRM"]},{"url":"https://code.google.com/p/phusion-passenger/issues/detail?id=910","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2013/07/16/6","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":5.1,"factors":[{"name":"EPSS percentile","points":5.13}]},"affected":[{"ecosystem":"RubyGems","package":"passenger","vulnerableRanges":["<4.0.6"],"patched":["4.0.6"],"from":["GHSA-w6rc-q387-vpgq"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0321","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-passenger-cve-2013-4136","children":[{"from":"CVE-2013-4136","to":"CVE-2014-1831","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:passenger","fromFixed":"4.0.6","toFixed":"4.0.38","daysApart":507},{"kind":"same-code","provenance":"machine","files":["ext/common/ServerInstanceDir.h"],"commits":["https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","https://github.com/phusion/passenger/commit/34b1087870c2bf85ebfd72c30b78577e10ab9744"],"basis":"shared function","functions":["ServerInstanceDir"]}]},{"from":"CVE-2013-4136","to":"CVE-2014-1832","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["ext/common/ServerInstanceDir.h"],"commits":["https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0"],"basis":"shared function","functions":["ServerInstanceDir"]}]}],"packageHistory":[{"cve":"CVE-2012-6135","published":"2019-11-19","fixed":"4.0.0.rc4","kev":false},{"cve":"CVE-2013-2119","published":"2014-01-02","fixed":"4.0.5","kev":false},{"cve":"CVE-2013-4136","published":"2013-09-30","fixed":"4.0.6","kev":false},{"cve":"CVE-2014-1831","published":"2015-02-19","fixed":"4.0.38","kev":false},{"cve":"CVE-2014-1832","published":"2015-02-19","fixed":"4.0.38","kev":false},{"cve":"CVE-2015-7519","published":"2016-01-08","fixed":"5.0.22","kev":false}],"package":"RubyGems:passenger"}}