CVE-2014-1838
Improper Link Resolution Before File Access in logilab-commons
CVE-2014-1838 is a medium vulnerability (CVSS 4.4) in Logilab Logilab-common, published March 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in logilab-common 0.61.0.
- Severity
- 4.4 MediumCVSS 2.0, NVD
- Exploit chance
- 0.34%EPSS, 28th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.61.0logilab-common +9 more
Description
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
logilab-commonPyPI | before 0.61.0 | 0.61.0 |
logilab-commonDebian:12 | before 0.61.0-1 | 0.61.0-1 |
logilab-commonDebian:13 | before 0.61.0-1 | 0.61.0-1 |
logilab-commonDebian:14 | before 0.61.0-1 | 0.61.0-1 |
logilab-commonPyPI | before 0.61.0, plus listed versions 0.28.10.38.00.38.10.39.00.43.0 Show 29 moreShow less0.44.00.46.00.46.10.47.00.48.10.49.00.50.00.50.10.50.20.50.30.51.00.51.10.52.00.52.10.53.00.54.00.55.00.55.20.56.00.56.10.56.20.57.00.57.10.58.10.58.30.59.00.59.10.60.00.60.1 | 0.61.0 |
python-logilab-commonMageia:3 From an advisory covering 2 CVEs | before 0.58.3-2.1.mga3 | 0.58.3-2.1.mga3 |
python-logilab-commonMageia:4 From an advisory covering 2 CVEs | before 0.60.0-3.1.mga4 | 0.60.0-3.1.mga4 |
logilab-commonPyPI | before 0.60.1, plus listed versions 0.28.10.38.00.38.10.39.00.43.0 Show 28 moreShow less0.44.00.46.00.46.10.47.00.48.10.49.00.50.00.50.10.50.20.50.30.51.00.51.10.52.00.52.10.53.00.54.00.55.00.55.20.56.00.56.10.56.20.57.00.57.10.58.10.58.30.59.00.59.10.60.0 | 0.60.1 |
python-logilab-commonopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 1.11.0-1.5 | 1.11.0-1.5 |
python-logilab-commonopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 2.1.0-1.4 | 2.1.0-1.4 |
What each source reports
NVD Score used
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
CVE-2014-1838- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE ListNo score
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
CVE-2014-1838- Updated
- 2026-11-02
EUVDEUVD-2014-0031No score
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
EUVD-2014-0031- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rr52-wg7f-8875
Improper Link Resolution Before File Access in logilab-commons
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-common before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
GHSA-rr52-wg7f-8875- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-rr52-wg7f-8875
Improper Link Resolution Before File Access in logilab-commons
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-common before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
GHSA-rr52-wg7f-8875- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVNo score
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
CVE-2014-1838- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2014-1838No score
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
DEBIAN-CVE-2014-1838- Updated
- 2026-11-02
OSVMGASA-2014-0118No score
Updated python-logilab-common packages fix security vulnerabilities
Updated python-logilab-common packages fix security vulnerabilities about temporary file handling (CVE-2014-1838 and CVE-2014-1839).
- Record
MGASA-2014-0118- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10400-1No score
python-logilab-common-1.0.2-1.4 on GA media
These are all security issues fixed in the python-logilab-common-1.0.2-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10400-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11235-1No score
python36-logilab-common-1.8.1-1.5 on GA media
These are all security issues fixed in the python36-logilab-common-1.8.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11235-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14145-1No score
python310-logilab-common-1.11.0-1.5 on GA media
These are all security issues fixed in the python310-logilab-common-1.11.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14145-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12014-1No score
python313-logilab-common-2.1.0-1.4 on GA media
These are all security issues fixed in the python313-logilab-common-2.1.0-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12014-1- Updated
- 2026-11-02
OSVPYSEC-2014-83No score
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
- Record
PYSEC-2014-83- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2014-02/msg00085.html
secunia.com/advisories/57209
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051
logilab.org/ticket/207561
comments.gmane.org/gmane.comp.security.oss.general/11986
nvd.nist.gov/vuln/detail/CVE-2014-1838
Show 10 moreShow less
github.com/advisories/GHSA-rr52-wg7f-8875
security-tracker.debian.org/tracker/CVE-2014-1838
advisories.mageia.org/MGASA-2014-0118.html
bugs.mageia.org/show_bug.cgi?id=12905
bugs.gentoo.org/show_bug.cgi?id=499872
bugzilla.redhat.com/show_bug.cgi?id=1060304
suse.com/security/cve/CVE-2014-1838