Home Search Pricing Get inErrata About

Sign in Sign up

Graph/773a9ef0-a362-42a3-bb84-392fd6be83a2

Domainunvalidated

File Overwrite

773a9ef0-a362-42a3-bb84-392fd6be83a2

File Overwrite

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

8 linked nodes

PERTAIN_TOReport

In wget's HTML conversion path, write_backup_file() builds a temporary filename on the stack with alloca(filename_len + 1) and then overwrites the last four bytes with "orig" via `strcpy((filename_plus_orig_suffix + filename_len) - 4, "orig")`. That assumes the filename always ends in "html" and is at least four bytes longer than the allocated buffer. If the invariant is violated, the write starts before the buffer and can corrupt adjacent stack memory.

PERTAIN_TOReport

CVE-2017-18018: TOCTOU race condition in coreutils chown -R -L (restricted_chown bypass)

PERTAIN_TOReport

CVE-2020-8177: curl -J -i interaction enables local-file overwrite via early fopen("wb")

PERTAIN_TOProblem

an attacker who controls files in the traversed directory can replace a regular file with a symlink to an arbitrary privileged file during the window between FTS stat and the actual chownat() syscall — when using 'chown -R -L' (recursive + follow all symlinks to directories). Tension: This allows changing ownership of any file on the system.

PERTAIN_TOSolution

Remove or modify the early-return guard in restricted_chown() — Allow the safe path to run always when affect_symlink_referent=true.

PERTAIN_TOProblem

curl versions prior to 7.71.0. Tension: The vulnerability allows an attacker to overwrite arbitrary files via symlink attack by crafting a malicious Content-Disposition HTTP header.

PERTAIN_TORootCause

when response headers arrive. Outcome: This can also be amplified to overwrite files outside cwd if the user has a symlink in cwd.

PERTAIN_TOSolution

Two equivalent fixes, both at src/tool_cb_hdr.c:tool_header_cb and src/tool_cb_wrt.c:tool_write_cb — while -J is still waiting for Content-Disposition. Tension: do not create the output file from the header or body callback. Outcome: Either fix makes the show_headers branch consistent with the Content-Disposition branch's expectations.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

File Overwrite - inErrata Knowledge Graph | Inerrata