CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- qualcomm, inc. snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8017 firmware +39 more +41 moreRace condition between the camera functions due to lack of resource lock which will lead to...8.1 High
- debian shadow, linux, fedoraproject fedora +4 more +6 moreshadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees4.7 Medium
- libuser, fedoraproject fedora, redhat enterprise linux +2 morelibuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and...6.3 Medium
- libbluray, debian linux, fedoraproject fedora +1 more +3 morelibbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files4.7 Medium
- qualcomm, inc. snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8017 firmware +34 more +36 moreRace condition due to the lack of resource lock which will be concurrently modified in the memcpy...7.0 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +9 more +11 moreA local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls,...7.8 High
- totaldefense anti-virusThe malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug;...5.9 Medium
- apport project apport, canonical ubuntu linux +1 moreRace condition between reading current working directory and writing a core dump4.2 Medium
- eclipse omr, the eclipse foundation eclipse omr +1 morePrior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to...7.4 High
- valvesoftware steam clientValve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to...7.0 High
- eclipse openj9, the eclipse foundation eclipse openj9, redhat enterprise linux desktop +3 more +5 moreAll builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to...7.4 High
- apport project apportApport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml6.5 Medium
- microsoft windows 10 version 1803, windows 10 version 1809, windows 10 version 1903 for 32-bit systems +8 more +10 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- handlebarsjs handlebars, netapp e-series performance analyzer +1 morePrototype Pollution5.6 Medium
- handlebarsjs handlebarsRemote Code Execution (RCE)5.6 Medium
- strato hidrive desktop client, telekom magentacloud, ionos 1\&1 online storage +2 moreSTRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation...8.8 High
- microsoft windows, windows server, windows 10 +7 more +9 moreAn elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV...7.8 High
- vmware esxi, fusion, workstation +1 more +3 moreVMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600...6.8 Medium
- plataformatec devise, devise ruby gem +1 moredevise Time-of-check Time-of-use Race Condition vulnerability9.8 Critical
- zoneminderA Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a...7.5 High
- keybaseIn Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check...9.8 Critical
- google chromeAn ability to process crash dumps under root privileges and inappropriate symlinks handling could...7.8 High
- qemu, [unknown] qemu:, canonical ubuntu linux +3 more +5 moreA flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in...5.0 Medium
- microsoft windows 10, windows 10 servers, windows server 2016 +1 more +3 moreAn elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced...7.8 High
- mcafee endpoint security for linux threat prevention (ensltp), endpoint security for linux threat prevention, endpoint security linux threat prevention +2 moreEndpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability5.6 Medium
- microsoft windows 10, windows 10 servers, windows server 2016 +2 moreA security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka ...3.3 Low
- [unknown] procps-ng, procps, procps project procps +1 moreprocps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's...3.9 Low
- microsoft windows 10, windows 10 servers, windows server 2016 +2 moreA security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka ...3.3 Low
- microsoft windows 10, windows server, windows server 2016 +1 more +3 moreDevice Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows...5.3 Medium
- gnu coreutilsfts.c in coreutils 8.4 allows local users to delete arbitrary files.4.7 Medium
- google androidA remote code execution vulnerability in the Android media framework (libstagefright). Product:...7.8 High
- google android, linux kernel +1 moreAn elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious...7.8 High
- google androidAn elevation of privilege vulnerability in the Framework APIs could enable a local malicious...7.8 High
- google androidAn elevation of privilege vulnerability in the Framework APIs could enable a local malicious...7.8 High
- libuser project libuser, opensuse, redhat enterprise linux +2 morelibuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the...7.2 High
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...5.1 Medium
- microsoft windows 7, windows server 2008, windows vista +2 moredxgkrnl.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2...7.2 High
- gnu cpio, canonical ubuntu linux, debian linux +2 moreRace condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary...4.7 Medium
- php, avaya converged communications server, debian linux +3 more +5 moreThe memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain...5.1 Medium
- microsoft windows 2000, windows 98, windows nt +2 more +4 moreA multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch...5.1 Medium