Homepage

Incorrect Permission Assignment for Critical Resource The advisory has been revoked - it doesn't affect any version of package xawtv  (opens in a new tab)

Threat Intelligence

EPSS
0.04% (5th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-XAWTV-5700931
  • published4 Jun 2020
  • disclosed8 Jun 2020
Report a new vulnerability Found a mistake?

Introduced: 4 Jun 2020

CVE-2020-13696  (opens in a new tab)
CWE-732  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:13.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xawtv package and not the xawtv package as distributed by Debian.

An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated by a v4l-conf -c /dev/../root/.bash_history command.

References