Pardus About
Monthly
Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.
Local information disclosure in Pardus About (versions 1.2.1 through 1.2.4) allows a low-privileged local user to read sensitive system data that should be restricted to higher-privileged users. The root cause is missing authorization checks (CWE-862) in the desktop information viewer component of the Pardus Linux distribution, developed by TUBITAK BILGEM. TR-CERT disclosed the issue with a fix available in version 1.2.5; no public exploit code or CISA KEV listing has been identified.
Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.
Local information disclosure in Pardus About (versions 1.2.1 through 1.2.4) allows a low-privileged local user to read sensitive system data that should be restricted to higher-privileged users. The root cause is missing authorization checks (CWE-862) in the desktop information viewer component of the Pardus Linux distribution, developed by TUBITAK BILGEM. TR-CERT disclosed the issue with a fix available in version 1.2.5; no public exploit code or CISA KEV listing has been identified.