CVE-2008-2958
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite...
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
Exploit likelihood
What each source reports
NVD Score used
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
CVE-2008-2958- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
CVE-2008-2958- Updated
- 2026-11-02
EUVDEUVD-2008-2948 No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
EUVD-2008-2948- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qcj-gpqg-c7cw No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite...
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
GHSA-9qcj-gpqg-c7cw- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
CVE-2008-2958- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2958 No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
DEBIAN-CVE-2008-2958- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
checkinstallDebian:12 |
before 1.6.1-7 | 1.6.1-7 |
checkinstallDebian:13 |
before 1.6.1-7 | 1.6.1-7 |
checkinstallDebian:14 |
before 1.6.1-7 | 1.6.1-7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2958 is a medium vulnerability (CVSS 4.4) in Checkinstall, published July 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in checkinstall 1.6.1-7.
References
secunia.com/advisories/30873
bugs.debian.org/cgi-bin/bugreport.cgi?bug=488140
lists.alioth.debian.org/pipermail/secure-testing-team/2008-June/001672.html
exchange.xforce.ibmcloud.com/vulnerabilities/43440
nvd.nist.gov/vuln/detail/CVE-2008-2958
github.com/advisories/GHSA-9qcj-gpqg-c7cw
security-tracker.debian.org/tracker/CVE-2008-2958