CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
84.1%
Severity: High
Date : 2016-10-16
CVE-ID : CVE-2016-8605 CVE-2016-8606
Package : guile
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package guile before version 2.0.13-1 is vulnerable to
multiple issues including arbitrary code execution and
information disclosure.
Upgrade to 2.0.13-1.
The problems have been fixed upstream in version 2.0.13.
Bind the REPL server to a Unix-domain socket.
guile --listen=/tmp/guile-socket
The mkdir procedure of GNU Guile, an implementation of the
Scheme programming language, temporarily changed the
process’ umask to zero. During that time window, in a
multithreaded application, other threads could end up
creating files with insecure permissions. For example, mkdir
without the optional mode argument would create directories
as 0777.
It was reported that the REPL server is vulnerable to the
HTTP inter- protocol attack. This constitutes a remote code
execution vulnerability for developers running a REPL server
that listens on a loopback device or private network.
Applications that do not run a REPL server, as is usually
the case, are unaffected.
A remote attacker is able to execute arbitrary code via a HTTP
inter-protocol attack if the REPL server is listening on a
loopback device or private network.
Running a multi-threaded guile application can cause
directories or files to be created with world
readable/writable/executable permissions during a small window
which leads to information disclosure.
http://www.openwall.com/lists/oss-security/2016/10/11/1
http://www.openwall.com/lists/oss-security/2016/10/12/2
https://access.redhat.com/security/cve/CVE-2016-8605
https://access.redhat.com/security/cve/CVE-2016-8606
https://lists.gnu.org/archive/html/info-gnu/2016-10/msg00009.html
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
84.1%