CVE-2008-4946: convirt 0.8.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/set_output t...

Security readout for executives and security teams

This is an old local file-overwrite issue in ConVirt 0.8.2. A user already on the same host could abuse unsafe temporary-file handling in provisioning scripts to redirect writes to another file. Business urgency is mainly for legacy virtualization management hosts with local multi-user access. Exposure is likely limited to systems still running ConVirt 0.8.2 or packages containing the listed image_store provisioning scripts. The cited issue is local, not remotely exploitable based on the provided sources. Internet-facing exposure is not supported unless remote access also grants local code execution or shell access. Treat as a targeted legacy cleanup item, not a broad emergency. Prioritize if ConVirt 0.8.2 exists on shared administration hosts, virtualization management servers, or systems where untrusted local users have access. Mitigation focus: Inventory and retire any ConVirt 0.8.2 installations.; Check Debian, Gentoo, or vendor guidance for fixed packages.; Restrict local shell access on affected hosts until remediated..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.