CVE-2024-34490

In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp

Medium · published May 5, 2024

CVSS v3.1
5.1
EPSS
0%
Percentile
7.2
In the wild
Unconfirmed
What it is

In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.2th percentile
Published
2024-05-05T00:00Z
EPSS history
Timeline
  • 05 MAY 00:00Z
    In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp
    cvelistv5