id: PYSEC-2016-41
modified: 2024-11-21T14:23:02.083165Z
published: 2016-09-07T19:28:00Z
aliases:
- CVE-2016-1242
details: file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12,
  3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with
  certain permissions to read arbitrary files via the name parameter or unspecified
  other vectors.
affected:
- package:
    ecosystem: PyPI
    name: tryton
    purl: pkg:pypi/tryton
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.2.17
  versions:
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.4.0
  - 1.4.1
  - 1.4.10
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 1.8.5
  - 1.8.6
  - 1.8.7
  - 1.8.8
  - 1.8.9
  - 2.0.0
  - 2.0.1
  - 2.0.10
  - 2.0.11
  - 2.0.12
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.0.8
  - 2.0.9
  - 2.2.0
  - 2.2.1
  - 2.2.10
  - 2.2.11
  - 2.2.12
  - 2.2.13
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.2.9
  - 2.4.0
  - 2.4.1
  - 2.4.10
  - 2.4.11
  - 2.4.12
  - 2.4.13
  - 2.4.14
  - 2.4.15
  - 2.4.16
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.4.9
  - 2.6.0
  - 2.6.1
  - 2.6.10
  - 2.6.11
  - 2.6.12
  - 2.6.13
  - 2.6.14
  - 2.6.15
  - 2.6.16
  - 2.6.2
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.6.6
  - 2.6.7
  - 2.6.8
  - 2.6.9
  - 2.8.0
  - 2.8.1
  - 2.8.10
  - 2.8.11
  - 2.8.12
  - 2.8.13
  - 2.8.14
  - 2.8.15
  - 2.8.16
  - 2.8.2
  - 2.8.3
  - 2.8.4
  - 2.8.5
  - 2.8.6
  - 2.8.7
  - 2.8.8
  - 2.8.9
  - 3.0.0
  - 3.0.1
  - 3.0.10
  - 3.0.11
  - 3.0.12
  - 3.0.13
  - 3.0.14
  - 3.0.15
  - 3.0.16
  - 3.0.17
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - 3.2.0
  - 3.2.1
  - 3.2.10
  - 3.2.11
  - 3.2.12
  - 3.2.13
  - 3.2.14
  - 3.2.15
  - 3.2.16
  - 3.2.2
  - 3.2.3
  - 3.2.4
  - 3.2.5
  - 3.2.6
  - 3.2.7
  - 3.2.8
  - 3.2.9
severity:
- type: CVSS_V3
  score: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
references:
- type: REPORT
  url: https://bugs.tryton.org/issue5808
- type: ADVISORY
  url: http://www.debian.org/security/2016/dsa-3656
- type: ADVISORY
  url: http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html