CVE-2013-4136.yml

---
gem: passenger
cve: 2013-4136
osvdb: 94074
ghsa: w6rc-q387-vpgq
url: https://nvd.nist.gov/vuln/detail/CVE-2013-4136
title:
  "CVE-2013-4136 rubygem-passenger: insecure temporary directory
  usage due toreuse of existing server instance directories"
date: 2013-06-10
description: |
  ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6
  for Ruby allows local users to gain privileges or possibly change the ownership
  of arbitrary directories via a symlink attack on a directory with a predictable
  name in /tmp/.
cvss_v2: 4.6
patched_versions:
  - ">= 4.0.8"