CVE-2017-11746

Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script executes a "kill cat /pathname/tenshi.pid" command.

References

Affected packages

Debian:11 / tenshi

Package

Name: tenshi
Purl: pkg:deb/debian/tenshi?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.13-2.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / tenshi

Package

Name: tenshi
Purl: pkg:deb/debian/tenshi?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.13-2.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / tenshi

Package

Name: tenshi
Purl: pkg:deb/debian/tenshi?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.13-2.1

Ecosystem specific

{
    "urgency": "unimportant"
}