Every CVE Search/ Get API key

CVE-2014-1624

pyxdg Arbitrary File Overwrite via Race Condition

3.3 LowFix available

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Exploit likelihood

0.32%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.3

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
CVE-2014-1624
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
CVE-2014-1624
Updated
2026-11-02
EUVDEUVD-2014-0096 No score

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
EUVD-2014-0096
Updated
2026-11-03
GitHub AdvisoriesGHSA-7372-q459-jxhr No score

pyxdg Arbitrary File Overwrite via Race Condition

Race condition in the xdg.BaseDirectory.get_runtime_dir function in pyxdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
GHSA-7372-q459-jxhr
Weakness
CWE-59
Updated
2026-11-02
OSV No score

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
CVE-2014-1624
Updated
2026-11-02
OSVDEBIAN-CVE-2014-1624 No score

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
DEBIAN-CVE-2014-1624
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-7372-q459-jxhr No score

pyxdg Arbitrary File Overwrite via Race Condition

Race condition in the xdg.BaseDirectory.get_runtime_dir function in pyxdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
GHSA-7372-q459-jxhr
Weakness
CWE-59
Updated
2026-11-02
OSVPYSEC-2014-95 No score

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
PYSEC-2014-95
Updated
2026-11-02
OSVSUSE-SU-2019:2719-1 No score

Security update for python-xdg

This update for python-xdg fixes the following issues:

Security issue fixed:

  • CVE-2014-1624: Fixed a TOCTOU race condition in get_runtime_dir(). (bsc#859835)
Record
SUSE-SU-2019:2719-1
Updated
2026-11-02
OSVSUSE-SU-2019:2719-2 No score

Security update for python-xdg

This update for python-xdg fixes the following issues:

Security issue fixed:

  • CVE-2014-1624: Fixed a TOCTOU race condition in get_runtime_dir(). (bsc#859835)
Record
SUSE-SU-2019:2719-2
Updated
2026-11-02
OSVUBUNTU-CVE-2014-1624 No score

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Record
UBUNTU-CVE-2014-1624
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pyxdg
PyPI
 through 0.25
0.26
pyxdg
Debian:12
 before 0.25-4
0.25-4
pyxdg
Debian:13
 before 0.25-4
0.25-4
pyxdg
Debian:14
 before 0.25-4
0.25-4
pyxdg
PyPI
 before 0.26, plus listed versions
0.190.200.210.220.230.240.25
0.26
pyxdg
PyPI
 0.25 up to 0.26
0.26
python-xdg
SUSE:Linux Enterprise Desktop 12 SP4
 before 0.25-9.3.1
0.25-9.3.1
python-xdg
SUSE:Linux Enterprise Server 12 SP4
 before 0.25-9.3.1
0.25-9.3.1
python-xdg
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 0.25-9.3.1
0.25-9.3.1
python-xdg
SUSE:Linux Enterprise Server 12 SP5
 before 0.25-9.3.1
0.25-9.3.1
python-xdg
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.25-9.3.1
0.25-9.3.1
pyxdg
Ubuntu:14.04:LTS
 before 0.25-4, plus listed versions
0.25-3
0.25-4
pyxdg
Ubuntu:16.04:LTS
 before 0.25-4
0.25-4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-1624 is a low vulnerability (CVSS 3.3) in Python Pyxdg, published January 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in pyxdg 0.26.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open