CVE catalog

CVE-2014-5254

xcfa: CVE-2014-5254

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxcfasid5.0.2-4fixed
Debianxcfaforky5.0.2-4fixed
Debianxcfatrixie5.0.2-3fixed
Debianxcfabookworm5.0.2-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxcfasourcesid5.0.1-1unimportantNot reported[756600]
Debianxcfasourceforky5.0.1-1unimportantNot reported[756600]
Debianxcfasourcetrixie5.0.1-1unimportantNot reported[756600]
Debianxcfasourcebookworm5.0.1-1unimportantNot reported[756600]

[Debian bug #756600]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [xcfa]Fixed
    Details (2)

    • 5.0.2-2 · amd64 · bookworm

      Fixed · Fixed: 5.0.1-1

      dsa · xcfa · debian · bookworm; dsa · xcfa · debian · 12

    • 5.0.2-2 · arm64 · bookworm

      Fixed · Fixed: 5.0.1-1

      dsa · xcfa · debian · bookworm; dsa · xcfa · debian · 12

[Debian 13 (Trixie)]

  • [xcfa]Fixed
    Details (2)

    • 5.0.2-3 · amd64 · trixie

      Fixed · Fixed: 5.0.1-1

      dsa · xcfa · debian · 13

    • 5.0.2-3 · arm64 · trixie

      Fixed · Fixed: 5.0.1-1

      dsa · xcfa · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]