CVE-2007-2837

The (1) getRule and (2) getChains functions in server/rules.cpp in fireflierd (fireflier-server)...

3.6 LowFix available

The (1) getRule and (2) getChains functions in server/rules.cpp in fireflierd (fireflier-server) in FireFlier 1.1.6 allow local users to overwrite arbitrary files via a symlink attack on the /tmp/fireflier.rules temporary file.

Exploit likelihood

0.34%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

Record: CVE-2007-2837
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-2837
Updated: 2026-11-02

EUVDEUVD-2007-2829 No score

Record: EUVD-2007-2829
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r6qg-rjj8-7pcm No score

The (1) getRule and (2) getChains functions in server/rules.cpp in fireflierd (fireflier-server)...

Record: GHSA-r6qg-rjj8-7pcm
Updated: 2026-11-02

Affected products

fireflier

Affected packages

Affected packages
Package	Affected	Fixed
`fireflier` Debian:3.1	before 1.1.5-1sarge1, plus listed versions 1.1.5-1	1.1.5-1sarge1
`fireflier` Debian:4.0	before 1.1.6-3etch1, plus listed versions 1.1.6-3	1.1.6-3etch1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, facts, published, references, title	GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-2837 is a low vulnerability (CVSS 3.6) in Fireflier, published July 1, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in fireflier 1.1.5-1sarge1.