{"id":"CVE-2013-6412","aliases":["DEBIAN-CVE-2013-6412","DLA-28-1","EUVD-2013-6231","GHSA-92m6-rfw4-wpq6","MGASA-2014-0058","RHSA-2014:0044","UBUNTU-CVE-2013-6412"],"status":"published","title":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly...","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","severity":{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00368,"percentile":0.30926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-01-23T00:00:00Z","modified":"2026-09-01T20:03:19Z","fixes":[{"ecosystem":"Debian:12","package":"augeas","fixed_in":["1.2.0-0.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"augeas","fixed_in":["1.2.0-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"augeas","fixed_in":["1.2.0-0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas-debuginfo","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas-libs","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas-devel","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas-debuginfo","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas-libs","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas-devel","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas-debuginfo","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas-libs","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas-devel","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas-debuginfo","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas-libs","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas-devel","fixed_in":["0:1.0.0-5.el6_5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-0.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-0.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-1+deb6u1"}]}],"versions":["0.7.2-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:3","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"augeas-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"augeas-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"augeas-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"augeas-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el6_5.1"}]}]}],"products":[{"vendor":"augeas","product":"augeas"}],"references":[{"url":"https://github.com/hercules-team/augeas/pull/58","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0044.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1034261","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://github.com/hercules-team/augeas/commit/f5b4fc0c","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6412","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-92m6-rfw4-wpq6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-6412","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0058.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11721","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-1537.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0044.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0044","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0044.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6412","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2013-6412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6412","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-6412","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"published","published":"2014-01-23T00:00:00Z","modified":"2024-08-06T17:39:01.18Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6231","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"published","published":"2014-01-23T00:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-92m6-rfw4-wpq6","title":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly...","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"published","published":"2022-05-17T04:54:13Z","modified":"2023-01-28T05:02:39Z","updated_at":"2026-11-02T14:43:49.260703Z"}],"nvd":[{"id":"CVE-2013-6412","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"published","published":"2014-01-23T00:55:03.3Z","modified":"2026-06-17T00:00:26.397Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-6412","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"published","published":"2014-01-23T00:55:03Z","modified":"2026-04-16T06:24:13.217792563Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-6412","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"published","published":"2014-01-23T00:55:03.3Z","modified":"2026-09-01T20:03:19.024578688Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-28-1","title":"augeas - security update","status":"published","published":"2014-08-01T00:00:00Z","modified":"2026-03-09T01:23:00.806289Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2014-0058","title":"Updated augeas package fixes security vulnerabilities","description":"Multiple flaws were found in the way Augeas handled configuration files\nwhen updating them. An application using Augeas to update configuration\nfiles in a directory that is writable to by a different user (for example,\nan application running as root that is updating files in a directory owned\nby a non-root service user) could have been tricked into overwriting\narbitrary files or leaking information via a symbolic link or mount point\nattack (CVE-2012-0786, CVE-2012-0787).\n\nA flaw was found in the way Augeas handled certain umask settings when\ncreating new configuration files. This flaw could result in configuration\nfiles being created as world writable, allowing unprivileged local users to\nmodify their content (CVE-2013-6412).\n","status":"published","published":"2014-02-12T17:10:49Z","modified":"2026-04-16T06:26:10.049403304Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2014:0044","title":"Red Hat Security Advisory: augeas security update","status":"published","published":"2024-09-15T21:13:57Z","modified":"2026-06-28T10:09:26Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-6412","description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","status":"withdrawn","published":"2014-01-23T00:55:00Z","modified":"2025-07-16T07:31:28.674714Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}