CVE-2008-2958
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite...
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
Exploit likelihood
What each source reports
NVD Score used
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
CVE-2008-2958- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE ListNo score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
CVE-2008-2958- Updated
- 2026-11-02
EUVDEUVD-2008-2948No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
EUVD-2008-2948- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qcj-gpqg-c7cwNo score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite...
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
GHSA-9qcj-gpqg-c7cw- Weakness
- CWE-362
- Updated
- 2026-11-02
OSVNo score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
CVE-2008-2958- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2958No score
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
- Record
DEBIAN-CVE-2008-2958- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
checkinstallDebian:12 | before 1.6.1-7 | 1.6.1-7 |
checkinstallDebian:13 | before 1.6.1-7 | 1.6.1-7 |
checkinstallDebian:14 | before 1.6.1-7 | 1.6.1-7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2958 is a medium vulnerability (CVSS 4.4) in Checkinstall, published July 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 21st percentile. Fixed in checkinstall 1.6.1-7.
References
secunia.com/advisories/30873
bugs.debian.org/cgi-bin/bugreport.cgi?bug=488140
lists.alioth.debian.org/pipermail/secure-testing-team/2008-June/001672.html
exchange.xforce.ibmcloud.com/vulnerabilities/43440
nvd.nist.gov/vuln/detail/CVE-2008-2958
github.com/advisories/GHSA-9qcj-gpqg-c7cw
security-tracker.debian.org/tracker/CVE-2008-2958