A vulnerability has been discovered in wyrd, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The vulnerability is caused due to wyrd creating a temporary file in an insecure manner. This can be exploited to overwrite arbitrary files with permissions of another user.

Successful exploitation requires that the user invokes the help function by pressing "?" within the user interface.

The vulnerability is confirmed in version 1.4.3b. Other versions may also be affected.

Solution
Update to version 1.4.4.

Provided and/or discovered by
Reported in a Debian bug.

Changelog
Further details available in Customer Area

Original Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466382

Deep Links
Links available in Customer Area