Every CVESearch/Get API key

CVE-2009-4029

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1...

4.4 MediumFix available

CVE-2009-4029 is a medium vulnerability (CVSS 4.4) in Gnu Automake, published December 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in automake 1:1.4-p6-13.1.

Severity
4.4 MediumCVSS 2.0, NVD
Exploit chance
0.48%EPSS, 42nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1:1.4-p6-13.1automake +11 more

Description

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Exploit likelihood

0.48%Down 0.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automake
Debian:14
before 1:1.4-p6-13.1, plus listed versions
1.0-01.0-11.0-41.3-11.3-2
Show 7 moreShow less
1.4-81:1.4-p4-1.11:1.4-p6-101:1.4-p6-111:1.4-p6-121:1.4-p6-131:1.4-p6-9
1:1.4-p6-13.1
automake
Red Hat:enterprise_linux:5::client_workstation
before 0:1.9.6-2.3.el5
0:1.9.6-2.3.el5
automake14
Red Hat:enterprise_linux:5::client_workstation
before 0:1.4p6-13.el5.1
0:1.4p6-13.el5.1
automake15
Red Hat:enterprise_linux:5::client_workstation
before 0:1.5-16.el5.2
0:1.5-16.el5.2
automake16
Red Hat:enterprise_linux:5::client_workstation
before 0:1.6.3-8.el5.1
0:1.6.3-8.el5.1
automake17
Red Hat:enterprise_linux:5::client_workstation
before 0:1.7.9-7.el5.2
0:1.7.9-7.el5.2
automake
Red Hat:enterprise_linux:5::server
before 0:1.9.6-2.3.el5
0:1.9.6-2.3.el5
automake14
Red Hat:enterprise_linux:5::server
before 0:1.4p6-13.el5.1
0:1.4p6-13.el5.1
automake15
Red Hat:enterprise_linux:5::server
before 0:1.5-16.el5.2
0:1.5-16.el5.2
automake16
Red Hat:enterprise_linux:5::server
before 0:1.6.3-8.el5.1
0:1.6.3-8.el5.1
automake17
Red Hat:enterprise_linux:5::server
before 0:1.7.9-7.el5.2
0:1.7.9-7.el5.2
automake
openSUSE:Tumbleweed
before 1.4.17-5.7
1.4.17-5.7

What each source reports

NVD Score used4.4

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
CVE-2009-4029
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-362
Updated
2026-11-02
CVE ListNo score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
CVE-2009-4029
Updated
2026-11-02
EUVDEUVD-2009-4000No score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
EUVD-2009-4000
Updated
2026-11-03
GitHub AdvisoriesGHSA-9xh2-rhpf-vx4pNo score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1...

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
GHSA-9xh2-rhpf-vx4p
Weakness
CWE-362
Updated
2026-11-02
OSVDEBIAN-CVE-2009-4029No score

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Record
DEBIAN-CVE-2009-4029
Updated
2026-11-02
OSVopenSUSE-SU-2024:10027-1No score

automake-1.15-4.6 on GA media

These are all security issues fixed in the automake-1.15-4.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10027-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10293-1No score

cppi-1.18-2.4 on GA media

These are all security issues fixed in the cppi-1.18-2.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10293-1
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 18 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open