CVE-2018-18654

Crossroads 2.81 does not properly handle the /tmp directory during a build
of xr. A local attacker can first create a world-writable subdirectory in a
certain location under the /tmp directory, wait until a user process copies
xr there, and then replace the entire contents of this subdirectory to
include a Trojan horse xr.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911877&gt;