CVE catalog

CVE-2009-4029

DEBIAN-CVE-2009-4029

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianautomake141.0-0vulnerable
Debianautomake141.0-1vulnerable
Debianautomake141.0-4vulnerable
Debianautomake141.3-1vulnerable
Debianautomake141.3-2vulnerable
Debianautomake141.4-8vulnerable
Debianautomake141:1.4-p4-1.1vulnerable
Debianautomake141:1.4-p6-10vulnerable
Debianautomake141:1.4-p6-11vulnerable
Debianautomake141:1.4-p6-12vulnerable
Debianautomake141:1.4-p6-13vulnerable
Debianautomake141:1.4-p6-9vulnerable
Debianautomake141:1.4-p6-13.1fixed
Opensuseautomaketumbleweed1.4.17-5.7fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianautomakedeb141:1.4-p6-13.1Not reportedDEBIAN-CVE-2009-4029Not reported
Opensuseautomakerpmtumbleweed1.4.17-5.7Not reportedOPENSUSE-SU-2024:10027-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [automake]Fixed

    Source package: [automake]

    Details (1)

    • 1.18.1-1.4 · noarch · tumbleweed

      Fixed · Fixed: 1.4.17-5.7

      pypi · automake · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]