CVE-2015-0858: Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in...

Security readout for executives and security teams

CVE-2015-0858 is a local file-write flaw in Cool Projects TarDiff. A user already on the system could abuse predictable temporary files under /tmp to redirect TarDiff output into another file. Business risk is mainly on shared Linux systems or servers where untrusted local users can run TarDiff. Exposure is likely limited to systems with TarDiff installed and usable by local users. Shared hosting, multi-user Unix systems, build hosts, or administrator workstations with untrusted local accounts are the most relevant environments. Treat this as a moderate hygiene issue unless TarDiff is present on shared or sensitive servers. Prioritize patching on multi-user systems because local file-write flaws can support privilege escalation chains, even when no public exploitation is cited. Mitigation focus: Check Debian DSA-3562 for the supported fixed package version.; Update TarDiff through the operating system's supported security repositories.; Remove TarDiff where it is not operationally required..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.