{"action":"Upgrade lazarus to 0.9.24-0-11 or later.","affected":[{"fixed":"0.9.24-0-11","introduced":"0"}],"component":"lazarus","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.9.24-0-11"],"id":"tcs_01M5N94XBAY7HDG4YV6X4EE4RS","modified_at":"2026-10-23T17:47:29.120815703Z","published_at":"2008-11-10T14:12:56.200Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2008-5007","https://security-tracker.debian.org/tracker/CVE-2008-5007"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2008-5007#Debian:13/lazarus","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2008-5007"}],"summary":"create_lazarus_export_tgz.sh in lazarus 0.9.24 allows local users to overwrite or delete arbitrary files via a symlink attack on a (1) /tmp/lazarus.tgz temporary file or a (2) /tmp/lazarus temporary d"}