GNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gv | Gnu | * | 3.6.9 (including) |
| Gv | Gnu | 3.5.8 (including) | 3.5.8 (including) |
| Gv | Gnu | 3.6.0 (including) | 3.6.0 (including) |
| Gv | Gnu | 3.6.1 (including) | 3.6.1 (including) |
| Gv | Gnu | 3.6.2 (including) | 3.6.2 (including) |
| Gv | Gnu | 3.6.3 (including) | 3.6.3 (including) |
| Gv | Gnu | 3.6.4 (including) | 3.6.4 (including) |
| Gv | Gnu | 3.6.5 (including) | 3.6.5 (including) |
| Gv | Gnu | 3.6.6 (including) | 3.6.6 (including) |
| Gv | Gnu | 3.6.7 (including) | 3.6.7 (including) |
| Gv | Gnu | 3.6.8 (including) | 3.6.8 (including) |
| Gv | Ubuntu | dapper | * |
| Gv | Ubuntu | hardy | * |
| Gv | Ubuntu | jaunty | * |
| Gv | Ubuntu | karmic | * |
| Gv | Ubuntu | lucid | * |
| Gv | Ubuntu | upstream | * |