VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Dec 31, 2011· Updated Apr 29, 2026

CVE-2011-4617

CVE-2011-4617

Description

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
virtualenvPyPI
< 1.51.5

Affected products

27
  • Python (programming language)/Virtualenv27 versions
    cpe:2.3:a:python:virtualenv:*:*:*:*:*:*:*:*+ 26 more
    • cpe:2.3:a:python:virtualenv:*:*:*:*:*:*:*:*range: <=1.4.9
    • cpe:2.3:a:python:virtualenv:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:python:virtualenv:1.4.8:*:*:*:*:*:*:*

Patches

1
68075ad9eded

Fixed #46 - Use a proper temp dir instead of /tmp.

https://github.com/pypa/virtualenvJannis LeidelJul 26, 2010via ghsa
commit
1 file changed · +3 −3
  • virtualenv.py+3 −3 modified
    @@ -10,6 +10,7 @@
 import re
 import shutil
 import logging
+import tempfile
 import distutils.sysconfig
 try:
     import subprocess
@@ -286,7 +287,6 @@ def _install_req(py_executable, unzip=False, distribute=False):
     if is_jython and os._name == 'nt':
         # Jython's .bat sys.executable can't handle a command line
         # argument with newlines
-        import tempfile
         fd, ez_setup = tempfile.mkstemp('.py')
         os.write(fd, bootstrap_script)
         os.close(fd)
@@ -324,10 +324,10 @@ def _filter_ez_setup(line):
         return filter_ez_setup(line, project_name)
 
     if not os.access(os.getcwd(), os.W_OK):
-        cwd = '/tmp'
+        cwd = tempfile.mkdtemp()
         if source is not None and os.path.exists(source):
             # the current working dir is hostile, let's copy the
-            # tarball to /tmp
+            # tarball to a temp dir
             target = os.path.join(cwd, os.path.split(source)[-1])
             shutil.copy(source, target)
     try:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.