{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"dpkg-cross","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5N94N283D6J5SC9Y5ZB03RP","modified_at":"2026-10-23T17:47:21.460794411Z","published_at":"2008-11-05T15:00:15.197Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2008-4950","https://security-tracker.debian.org/tracker/CVE-2008-4950"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2008-4950#Debian:14/dpkg-cross","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2008-4950"}],"summary":"gccross in dpkg-cross 2.3.0 allows local users to overwrite arbitrary files via a symlink attack on the tmp/gccross2.log temporary file. NOTE: the vendor disputes this vulnerability, stating that \"The"}