Insecure Use of /tmp Socket File in Libmenu-cache 1.0.2
Summary
CVE-2017-8933: Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability). Affects menu-cache versions < 1.0.2-3. Fixed in 1.0.2-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libmenu-cache is a library used for creating and managing caches of freedesktop.org compliant menus. It provides a simple API to create and manage caches, allowing applications to efficiently load and display menus. However, in version 1.0.2, Libmenu-cache insecurely uses the /tmp directory for a socket file, which can be exploited by a local user to cause a denial of service by rendering the menu unavailable.
Vulnerability Detail
The vulnerability (CVE-2017-8933) arises from the insecure use of the /tmp directory for a socket file. By manipulating the socket file, a local user can disrupt the functionality of the menu, leading to a denial of service. This vulnerability does not allow for remote exploitation or privilege escalation. The CVSSv3 score for this vulnerability is 3.3, indicating a low severity level.
How To Fix
Minimum fixed version
1.0.2-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade menu-cacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In summary, Libmenu-cache 1.0.2 suffers from an insecure use of the /tmp directory for a socket file, which can be exploited by a local user to cause a denial of service. It is recommended to update to version 1.0.2-3 of the menu-cache package to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for menu-cache →
FAQ
Libmenu-cache is a library used for creating and managing caches of freedesktop.org compliant menus. It provides a simple API to create and manage caches, allowing applications to efficiently load and display menus.
The vulnerability allows a local user to cause a denial of service by rendering the menu unavailable. However, it does not allow for remote exploitation or privilege escalation.
No, remote exploitation is not possible with this vulnerability. It can only be exploited by a local user.
The CVSSv3 score for this vulnerability is 3.3, indicating a low severity level.
To fix this vulnerability, update to version 1.0.2-3 of the menu-cache package.
Related vulnerabilities
Recent vulnerabilities recorded for menu-cache.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
