Source: tinyproxy Version: 1.8.3-3 Severity: normal Tags: upstream security Forwarded: https://github.com/tinyproxy/tinyproxy/issues/106
Hi, the following vulnerability was published for tinyproxy, opeing this in the BTS for tracking purposes. CVE-2017-11747[0]: | main.c in Tinyproxy 1.8.4 and earlier creates a | /run/tinyproxy/tinyproxy.pid file after dropping privileges to a | non-root account, which might allow local users to kill arbitrary | processes by leveraging access to this non-root account for | tinyproxy.pid modification before a root script executes a "kill `cat | /run/tinyproxy/tinyproxy.pid`" command. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-11747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11747 Regards, Salvatore
