Every CVE Search/ Get API key

CVE-2009-4029

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1...

4.4 MediumFix available

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Exploit likelihood

0.48%Down 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.4

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
CVE-2009-4029
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
CVE-2009-4029
Updated
2026-11-02
EUVDEUVD-2009-4000 No score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
EUVD-2009-4000
Updated
2026-11-03
GitHub AdvisoriesGHSA-9xh2-rhpf-vx4p No score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1...

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
GHSA-9xh2-rhpf-vx4p
Weakness
CWE-362
Updated
2026-11-02
OSVDEBIAN-CVE-2009-4029 No score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
DEBIAN-CVE-2009-4029
Updated
2026-11-02
OSVopenSUSE-SU-2024:10027-1 No score

automake-1.15-4.6 on GA media

These are all security issues fixed in the automake-1.15-4.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10027-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10293-1 No score

cppi-1.18-2.4 on GA media

These are all security issues fixed in the cppi-1.18-2.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10293-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automake
Debian:14
 before 1:1.4-p6-13.1, plus listed versions
1.0-01.0-11.0-41.3-11.3-2
Show 7 moreShow less
1.4-81:1.4-p4-1.11:1.4-p6-101:1.4-p6-111:1.4-p6-121:1.4-p6-131:1.4-p6-9
1:1.4-p6-13.1
automake
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.9.6-2.3.el5
0:1.9.6-2.3.el5
automake14
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.4p6-13.el5.1
0:1.4p6-13.el5.1
automake15
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.5-16.el5.2
0:1.5-16.el5.2
automake16
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.6.3-8.el5.1
0:1.6.3-8.el5.1
automake17
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.7.9-7.el5.2
0:1.7.9-7.el5.2
automake
Red Hat:enterprise_linux:5::server
 before 0:1.9.6-2.3.el5
0:1.9.6-2.3.el5
automake14
Red Hat:enterprise_linux:5::server
 before 0:1.4p6-13.el5.1
0:1.4p6-13.el5.1
automake15
Red Hat:enterprise_linux:5::server
 before 0:1.5-16.el5.2
0:1.5-16.el5.2
automake16
Red Hat:enterprise_linux:5::server
 before 0:1.6.3-8.el5.1
0:1.6.3-8.el5.1
automake17
Red Hat:enterprise_linux:5::server
 before 0:1.7.9-7.el5.2
0:1.7.9-7.el5.2
automake
openSUSE:Tumbleweed
 before 1.4.17-5.7
1.4.17-5.7

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4029 is a medium vulnerability (CVSS 4.4) in Gnu Automake, published December 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in automake 1:1.4-p6-13.1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open