CVE-2012-4454

Description

openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.

How to fix CVE-2012-4454

To remediate CVE-2012-4454, upgrade the affected package to a fixed version below.

• Debian/opencryptoki—upgrade to 3.4.1+dfsg-1 or later

Is CVE-2012-4454 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 3.4.1+dfsg-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2012-4454