Every CVE Search/ Get API key

CVE-2016-8605

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time...

5.3 MediumFix available

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

2.77%Up 1.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.3

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
CVE-2016-8605
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-275
Updated
2026-11-02
CVE List No score

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
CVE-2016-8605
Updated
2026-11-02
EUVDEUVD-2016-9452 No score

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
EUVD-2016-9452
Updated
2026-11-03
GitHub AdvisoriesGHSA-jxp8-7966-cm98 5.3

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time...

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
GHSA-jxp8-7966-cm98
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALPINE-CVE-2016-8605 5.3

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
ALPINE-CVE-2016-8605
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSV 5.3

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
CVE-2016-8605
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2016-8605 5.3

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Record
UBUNTU-CVE-2016-8605
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVMGASA-2016-0354 No score

Updated guile packages fix security vulnerability

The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions (CVE-2016-8605).

GNU Guile, an implementation of the Scheme language, provides a “REPL server” which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is vulnerable to the HTTP inter-protocol attack. This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network (CVE-2016-8606).

The guile package has been updated to version 2.0.13, fixing these issues and other bugs. See the upstream release announcements for details.

Record
MGASA-2016-0354
Updated
2026-11-02
OSVMGASA-2021-0340 No score

Updated guile1.8 packages fix security vulnerabilities

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected (CVE-2016-8605).

Record
MGASA-2021-0340
Updated
2026-11-02
OSVopenSUSE-SU-2023:0137-1 No score

Security update for guile1, lilypond

This update for guile1, lilypond fixes the following issues:

guile1:

  • Add service file to download release from git excluding the directory with commercial non free files.
  • Update to version 2.2.6 to enable lilypond to be updated to 2.24.1 to fix boo#1210502 and CVE-2020-17354.

lilypond:

  • Update to version lilypond-2.24.1 to fix boo#1210502 - CVE-2020-17354: lilypond: Lilypond allows attackers to bypass the -dsafe protection mechanism.
Record
openSUSE-SU-2023:0137-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10389-1 No score

guile-2.0.13-2.1 on GA media

These are all security issues fixed in the guile-2.0.13-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10389-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10415-1 No score

guile1-1.8.8-19.3 on GA media

These are all security issues fixed in the guile1-1.8.8-19.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10415-1
Updated
2026-11-02
OSVSUSE-SU-2017:0394-1 No score

Security update for guile

This update for guile fixes the following issues:

  • CVE-2016-8605: Fixed thread-unsafe umask modification (bsc#1004221).
Record
SUSE-SU-2017:0394-1
Updated
2026-11-02
OSVSUSE-SU-2017:0398-1 No score

Security update for guile

This update for guile fixes the following issues:

  • CVE-2016-8605: Fixed thread-unsafe umask modification (bsc#1004221).
Record
SUSE-SU-2017:0398-1
Updated
2026-11-02
OSVSUSE-SU-2020:1659-1 No score

Security update for guile

This update for guile fixes the following issues:

  • CVE-2016-8605: Fixed thread-unsafe umask modification (bsc#1004221).
Record
SUSE-SU-2020:1659-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
guile
Alpine:v3.4
 before 2.0.11-r3
2.0.11-r3
guile-2.0
Debian:7
 before 2.0.5+1-3+deb7u1, plus listed versions
2.0.5+1-3
2.0.5+1-3+deb7u1
guile
Mageia:5
 before 2.0.13-1.mga5
2.0.13-1.mga5
guile1.8
Mageia:7
 before 1.8.8-25.1.mga7
1.8.8-25.1.mga7
guile
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 1.8.5-24.1
1.8.5-24.1
guile
SUSE:Linux Enterprise Server 11 SP4
 before 1.8.5-24.1
1.8.5-24.1
guile
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 1.8.5-24.1
1.8.5-24.1
guile
SUSE:Linux Enterprise Desktop 12 SP1
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Desktop 12 SP2
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.0.9-8.3
2.0.9-8.3
Show 17 moreShow less
Affected packages
PackageAffectedFixed
guile
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Server 12 SP1
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Server 12 SP2
 before 2.0.9-8.3
2.0.9-8.3
guile
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.0.9-8.3
2.0.9-8.3
guile1
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 1.8.8-16.4.39
1.8.8-16.4.39
guile1
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.8.8-16.4.39
1.8.8-16.4.39
guile1
SUSE:Linux Enterprise Workstation Extension 12 SP4
 before 1.8.8-16.4.39
1.8.8-16.4.39
guile1
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 1.8.8-16.4.39
1.8.8-16.4.39
guile-2.0
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.11+1-9ubuntu12.0.11+1-102.0.11+1-10ubuntu0.1
 None known
guile-1.8
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.8.8+1-10ubuntu1
 None known
guile1
SUSE:Package Hub 15 SP4
 before 2.2.6-bp154.3.3.1
2.2.6-bp154.3.3.1
lilypond
SUSE:Package Hub 15 SP4
 before 2.24.1-bp154.2.3.2
2.24.1-bp154.2.3.2
guile1
openSUSE:Leap 15.4
 before 2.2.6-bp154.3.3.1
2.2.6-bp154.3.3.1
lilypond
openSUSE:Leap 15.4
 before 2.24.1-bp154.2.3.2
2.24.1-bp154.2.3.2
guile
openSUSE:Tumbleweed
 before 2.0.13-2.1
2.0.13-2.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-8605 is a medium vulnerability (CVSS 5.3) in Gnu Guile, published October 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.77%, the 86th percentile. Fixed in guile 2.0.11-r3.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open