CVE catalog

CVE-2013-4969

puppet - insecure temporary files

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 27, 2026

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppet113.4.1-1fixed
Debianpuppet6.02.6.2-4vulnerable
Debianpuppet6.02.6.2-5vulnerable
Debianpuppet6.02.6.2-5+squeeze1vulnerable
Debianpuppet6.02.6.2-5+squeeze3vulnerable
Debianpuppet6.02.6.2-5+squeeze4vulnerable
Debianpuppet6.02.6.2-5+squeeze5vulnerable
Debianpuppet6.02.6.2-5+squeeze6vulnerable
Debianpuppet6.02.6.2-5+squeeze7vulnerable
Debianpuppet6.02.6.2-5+squeeze8vulnerable
Debianpuppet6.02.6.2-5+squeeze9fixed
Debianpuppet72.7.18-4vulnerable
Debianpuppet72.7.18-5vulnerable
Debianpuppet72.7.23-1~deb7u1vulnerable
Debianpuppet72.7.23-1~deb7u2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppetdeb113.4.1-1Not reportedDEBIAN-CVE-2013-4969Not reported
Debianpuppetdeb6.02.6.2-5+squeeze9Not reportedDSA-2831-1Not reported
Debianpuppetdeb72.7.23-1~deb7u2Not reportedDSA-2831-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]