CVE-2014-1839
Creation of Temporary File With Insecure Permissions in logilab-commons
CVE-2014-1839 is a medium vulnerability (CVSS 4.4) in Logilab Logilab-common, published March 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in logilab-common 0.61.0.
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
Exploit likelihood
What each source reports
NVD Score used
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
CVE-2014-1839- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
CVE-2014-1839- Updated
- 2026-11-02
EUVDEUVD-2014-0032 No score
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
EUVD-2014-0032- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g5m2-22h2-rr3j
Creation of Temporary File With Insecure Permissions in logilab-commons
The Execute class in shellutils in logilab-common before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
GHSA-g5m2-22h2-rr3j- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
OSVGHSA-g5m2-22h2-rr3j
Creation of Temporary File With Insecure Permissions in logilab-commons
The Execute class in shellutils in logilab-common before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
GHSA-g5m2-22h2-rr3j- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
OSV No score
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
CVE-2014-1839- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2014-1839 No score
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
DEBIAN-CVE-2014-1839- Updated
- 2026-11-02
OSVMGASA-2014-0118 No score
Updated python-logilab-common packages fix security vulnerabilities
Updated python-logilab-common packages fix security vulnerabilities about temporary file handling (CVE-2014-1838 and CVE-2014-1839).
- Record
MGASA-2014-0118- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10400-1 No score
python-logilab-common-1.0.2-1.4 on GA media
These are all security issues fixed in the python-logilab-common-1.0.2-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10400-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11235-1 No score
python36-logilab-common-1.8.1-1.5 on GA media
These are all security issues fixed in the python36-logilab-common-1.8.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11235-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14145-1 No score
python310-logilab-common-1.11.0-1.5 on GA media
These are all security issues fixed in the python310-logilab-common-1.11.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14145-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12014-1 No score
python313-logilab-common-2.1.0-1.4 on GA media
These are all security issues fixed in the python313-logilab-common-2.1.0-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12014-1- Updated
- 2026-11-02
OSVPYSEC-2014-84 No score
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
- Record
PYSEC-2014-84- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
logilab-commonPyPI |
before 0.61.0 | 0.61.0 |
logilab-commonDebian:12 |
before 0.61.0-1 | 0.61.0-1 |
logilab-commonDebian:13 |
before 0.61.0-1 | 0.61.0-1 |
logilab-commonDebian:14 |
before 0.61.0-1 | 0.61.0-1 |
logilab-commonPyPI |
before 0.61.0, plus listed versions 0.28.10.38.00.38.10.39.00.43.0 Show 29 moreShow less0.44.00.46.00.46.10.47.00.48.10.49.00.50.00.50.10.50.20.50.30.51.00.51.10.52.00.52.10.53.00.54.00.55.00.55.20.56.00.56.10.56.20.57.00.57.10.58.10.58.30.59.00.59.10.60.00.60.1 |
0.61.0 |
python-logilab-commonMageia:3 |
before 0.58.3-2.1.mga3 | 0.58.3-2.1.mga3 |
python-logilab-commonMageia:4 |
before 0.60.0-3.1.mga4 | 0.60.0-3.1.mga4 |
logilab-commonPyPI |
before 0.60.1, plus listed versions 0.28.10.38.00.38.10.39.00.43.0 Show 28 moreShow less0.44.00.46.00.46.10.47.00.48.10.49.00.50.00.50.10.50.20.50.30.51.00.51.10.52.00.52.10.53.00.54.00.55.00.55.20.56.00.56.10.56.20.57.00.57.10.58.10.58.30.59.00.59.10.60.0 |
0.60.1 |
python-logilab-commonopenSUSE:Tumbleweed |
before 1.11.0-1.5 | 1.11.0-1.5 |
python-logilab-commonopenSUSE:Tumbleweed |
before 2.1.0-1.4 | 2.1.0-1.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
logilab.org/ticket/207562
lists.opensuse.org/opensuse-updates/2014-02/msg00085.html
secunia.com/advisories/57209
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051
comments.gmane.org/gmane.comp.security.oss.general/11986
nvd.nist.gov/vuln/detail/CVE-2014-1839
Show 10 moreShow less
github.com/advisories/GHSA-g5m2-22h2-rr3j
security-tracker.debian.org/tracker/CVE-2014-1839
advisories.mageia.org/MGASA-2014-0118.html
bugs.mageia.org/show_bug.cgi?id=12905
bugs.gentoo.org/show_bug.cgi?id=499872
bugzilla.redhat.com/show_bug.cgi?id=1060304
suse.com/security/cve/CVE-2014-1838