CVE-1999-1498 Path traversal in n/a

What is CVE-1999-1498?

CVE-1999-1498 is a low-severity path traversal vulnerability in Slackware Slackware Linux, published on 12 Sep 2001. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Slackware Linux 3.4 pkgtool allows local attacker to read and write to arbitrary files via a symlink attack on the reply file.

Which versions are affected by CVE-1999-1498?

It affects 1 product.

Products include Slackware Slackware Linux.

How do I fix CVE-1999-1498?

No fix has been published for CVE-1999-1498 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-1999-1498 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-1999-1498 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Slackware Slackware Linux

• CVE-2013-7171 Misconfiguration in n/a Critical 9.8
• CVE-2013-7172 Privilege escalation in n/a High 7.8
• CVE-2003-0335 Security feature bypass in n/a High 7.5
• CVE-1999-0242 Information disclosure in n/a High 7.5
• CVE-1999-0298 Path traversal in n/a High 7.5

All Slackware Slackware Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r9wh-3q4r-xc56.