CVE-2012-4453

dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.

• CWE-276

• http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71
• http://rhn.redhat.com/errata/RHSA-2013-1674.htmlThird Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/27/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/27/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/27/6Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/55713Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=859448Issue Tracking, Patch, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79258Third Party Advisory, VDB Entry
• http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71
• http://rhn.redhat.com/errata/RHSA-2013-1674.htmlThird Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/27/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/27/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/27/6Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/55713Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=859448Issue Tracking, Patch, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79258Third Party Advisory, VDB Entry

Published

Oct 9, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4447Heap-based buffer overflow in tif_pixarlog.c in LibTIFF befo…
• CVE-2012-4448Cross-site request forgery (CSRF) vulnerability in wp-admin/…
• CVE-2012-4449Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x befor…
• CVE-2012-4450389 Directory Server 1.2.10 does not properly update the ACL…
• CVE-2012-4451Multiple cross-site scripting (XSS) vulnerabilities in Zend …6.1
• CVE-2012-4452MySQL 5.0.88, and possibly other versions and platforms, all…
• CVE-2012-4454openCryptoki before 2.4.1, when using spinlocks, allows loca…
• CVE-2012-4455openCryptoki 2.4.1 allows local users to create or set world…
• CVE-2012-4456The (1) OS-KSADM/services and (2) tenant APIs in OpenStack K…
• CVE-2012-4457OpenStack Keystone Essex before 2012.1.2 and Folsom before f…
• CVE-2012-4458The AMQP type decoder in Apache Qpid 0.20 and earlier allows…
• CVE-2012-4459Integer overflow in the qpid::framing::Buffer::checkAvailabl…