VYPR
← All advisories
High severityNVD Advisory· Published Mar 11, 2014· Updated May 6, 2026

CVE-2014-1838

CVE-2014-1838

Description

The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
logilab-commonPyPI
< 0.61.00.61.0

Affected products

3
  • Logilab/Logilab Common
    cpe:2.3:a:logilab:logilab-common:*:*:*:*:*:*:*:*
    Range: <=0.60.0
  • OpenSUSE/openSUSE2 versions
    cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.