CVE Feed

    Dashboard / CVE / CVE-2012-4454

    CVE-2012-4454

    openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.

    Published:Sep 7, 2012
    Last Modified:Apr 11, 2025
    EPS:Oct 10, 2012
    EPSS Score:0.0053
    CVSS Score:2.9

    Affected Products

    Vendor
    Opencryptoki Project
    Product
    Opencryptoki

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-377 Insecure Temporary File

    Related CVEs

    CVE-2026-40253 (CVSS 6.8) — openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BE…
    CVE-2026-23893 (CVSS 6.8) — openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnera…
    CVE-2026-22791 (CVSS 6.6) — openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer ov…
    CVE-2024-0914 (CVSS 5.9) — A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#…
    CVE-2021-3798 (CVSS 5.5) — A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC …
    CVE-2012-4455 (CVSS 6.2) — openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a sym…

    References

    http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9
    http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30
    http://secunia.com/advisories/50702
    http://sourceforge.net/mailarchive/message.php?msg_id=28878345
    http://www.openwall.com/lists/oss-security/2012/09/07/2
    http://www.openwall.com/lists/oss-security/2012/09/07/6
    http://www.openwall.com/lists/oss-security/2012/09/09/2
    http://www.openwall.com/lists/oss-security/2012/09/20/6
    http://www.openwall.com/lists/oss-security/2012/09/25/5
    http://www.openwall.com/lists/oss-security/2012/09/27/2
    http://www.securityfocus.com/bid/55627
    https://bugzilla.redhat.com/show_bug.cgi?id=730636
    https://exchange.xforce.ibmcloud.com/vulnerabilities/78797
    http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9
    http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30
    http://secunia.com/advisories/50702
    http://sourceforge.net/mailarchive/message.php?msg_id=28878345
    http://www.openwall.com/lists/oss-security/2012/09/07/2
    http://www.openwall.com/lists/oss-security/2012/09/07/6
    http://www.openwall.com/lists/oss-security/2012/09/09/2
    http://www.openwall.com/lists/oss-security/2012/09/20/6
    http://www.openwall.com/lists/oss-security/2012/09/25/5
    http://www.openwall.com/lists/oss-security/2012/09/27/2
    http://www.securityfocus.com/bid/55627
    https://bugzilla.redhat.com/show_bug.cgi?id=730636
    https://exchange.xforce.ibmcloud.com/vulnerabilities/78797

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High