Vulnerabilities > CVE-2014-1420 - Deserialization of Untrusted Data vulnerability in Canonical Ubuntu-Ui-Toolkit
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver would also open files without the O_EXCL flag. An attacker could exploit this to launch a symlink attack, though this is partially mitigated by symlink and hardlink restrictions in Ubuntu. Fixed in 1.1.1188+14.10.20140813.4-0ubuntu1.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |