CVE-2014-1639
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe...
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Exploit likelihood
What each source reports
NVD Score used
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Record
CVE-2014-1639- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Record
CVE-2014-1639- Updated
- 2026-11-02
EUVDEUVD-2014-1713 No score
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Record
EUVD-2014-1713- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wvp4-7f3w-g9qj No score
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe...
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Record
GHSA-wvp4-7f3w-g9qj- Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Record
CVE-2014-1639- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1639 No score
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Record
DEBIAN-CVE-2014-1639- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
syncevolutionDebian:12 |
before 1.3.99.7-1 | 1.3.99.7-1 |
syncevolutionDebian:14 |
before 1.3.99.7-1, plus listed versions 0.9+ds1-20.9.1+ds1-11.0+ds1~a1-11.0+ds1~a1-21.0+ds1~beta2a-1 Show 14 moreShow less1.0+ds1~beta2a-21.1+ds1-11.1+ds1-21.1+ds1-31.1+ds1-41.1+ds1-51.1.99.3+ds1-11.1.99.5a-11.1.99.5a-21.2.1-11.2.2-11.2.99.1-11.2.99.1-1.11.3.2-1 |
1.3.99.7-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1639 is a low vulnerability (CVSS 3.3) in Debian Syncevolution, published January 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in syncevolution 1.3.99.7-1.
References
openwall.com/lists/oss-security/2014/01/22/4
exchange.xforce.ibmcloud.com/vulnerabilities/90662
osvdb.org/102380
bugs.debian.org/cgi-bin/bugreport.cgi?bug=736357
securityfocus.com/bid/65098
nvd.nist.gov/vuln/detail/CVE-2014-1639
github.com/advisories/GHSA-wvp4-7f3w-g9qj
security-tracker.debian.org/tracker/CVE-2014-1639