Every CVE Search/ Get API key

CVE-2012-0787

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set...

3.7 LowFix available

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Exploit likelihood

0.42%Down 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.7

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Record
CVE-2012-0787
CVSS 2.0
3.7 LowAV:L/AC:H/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Record
CVE-2012-0787
Updated
2026-11-02
EUVDEUVD-2012-0818 No score

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Record
EUVD-2012-0818
Updated
2026-11-03
GitHub AdvisoriesGHSA-8qr9-h3xv-vhx6 No score

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set...

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Record
GHSA-8qr9-h3xv-vhx6
Updated
2026-11-02
OSV No score

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Record
CVE-2012-0787
Updated
2026-11-02
OSVDEBIAN-CVE-2012-0787 No score

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.

Record
DEBIAN-CVE-2012-0787
Updated
2026-11-02
OSVMGASA-2014-0058 No score

Updated augeas package fixes security vulnerabilities

Multiple flaws were found in the way Augeas handled configuration files when updating them. An application using Augeas to update configuration files in a directory that is writable to by a different user (for example, an application running as root that is updating files in a directory owned by a non-root service user) could have been tricked into overwriting arbitrary files or leaking information via a symbolic link or mount point attack (CVE-2012-0786, CVE-2012-0787).

A flaw was found in the way Augeas handled certain umask settings when creating new configuration files. This flaw could result in configuration files being created as world writable, allowing unprivileged local users to modify their content (CVE-2013-6412).

Record
MGASA-2014-0058
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
augeas
Debian:12
 before 1.0.0-1
1.0.0-1
augeas
Debian:13
 before 1.0.0-1
1.0.0-1
augeas
Debian:14
 before 1.0.0-1
1.0.0-1
augeas
Debian:6.0
From an advisory covering 3 CVEs
 before 0.7.2-1+deb6u1, plus listed versions
0.7.2-1
0.7.2-1+deb6u1
augeas
Mageia:3
From an advisory covering 3 CVEs
 before 1.1.0-1.1.mga3
1.1.0-1.1.mga3
augeas
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
Show 15 moreShow less
Affected packages
PackageAffectedFixed
augeas-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas
Red Hat:enterprise_linux:6::hypervisor
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-debuginfo
Red Hat:enterprise_linux:6::hypervisor
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas
Red Hat:storage:3:server:el6
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-debuginfo
Red Hat:storage:3:server:el6
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6
augeas-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.0.0-5.el6
0:1.0.0-5.el6

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0787 is a low vulnerability (CVSS 3.7) in Augeas, published November 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in augeas 1.0.0-1.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open