Candidate: CVE-2013-2035
PublicDate: 2013-08-28 23:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2035
 https://rhn.redhat.com/errata/RHSA-2013-1029.html
Description:
 Race condition in
 hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java
 in HawtJNI before 1.8, when a custom library path is not specified, allows
 local users to execute arbitrary Java code by overwriting a temporary JAR
 file with a predictable name in /tmp.
Ubuntu-Description:
 It was discovered that HawtJNI wrote files with predictable names to /tmp. A 
 local attacker could exploit a race condition by overwriting the predictably
 named temporary files, resulting in arbitrary code execution.
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708293
Priority: low
Discovered-by:
Assigned-to:
CVSS: 

Tags_hawtjni: symlink-restriction
Patches_hawtjni:
 upstream: https://github.com/fusesource/hawtjni/commit/92c266170ce98edc200c656bd034a237098b8aa5
upstream_hawtjni: released (1.10-1)
lucid_hawtjni: DNE
precise_hawtjni: ignored (reached end-of-life)
precise/esm_hawtjni: DNE (precise was needs-triage)
quantal_hawtjni: ignored (reached end-of-life)
raring_hawtjni: ignored (reached end-of-life)
saucy_hawtjni: ignored (reached end-of-life)
trusty_hawtjni: released (1.0~+git0c502e20c4-3+deb7u1build0.14.04.1)
trusty/esm_hawtjni: released (1.0~+git0c502e20c4-3+deb7u1build0.14.04.1)

utopic_hawtjni: ignored (reached end-of-life)
vivid_hawtjni: ignored (reached end-of-life)
vivid/stable-phone-overlay_hawtjni: DNE
vivid/ubuntu-core_hawtjni: DNE
wily_hawtjni: ignored (reached end-of-life)
xenial_hawtjni: not-affected (1.10-1)
yakkety_hawtjni: ignored (reached end-of-life)
zesty_hawtjni: ignored (reached end-of-life)
artful_hawtjni: ignored (reached end-of-life)
bionic_hawtjni: not-affected (1.10-1)
cosmic_hawtjni: not-affected (1.10-1)
devel_hawtjni: not-affected (1.10-1)