{"id":"GHSA-ppc3-fpvh-7396","summary":"Improper synchronization in Apache Netbeans HTML/Java API","details":"There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file.","aliases":["CVE-2020-17534"],"modified":"2023-11-08T04:02:43.124320Z","published":"2022-02-09T22:25:18Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-04-06T22:32:25Z","nvd_published_at":"2021-01-11T16:15:00Z","cwe_ids":["CWE-362"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17534"},{"type":"WEB","url":"https://github.com/apache/netbeans-html4j/commit/fa70e507e5555e1adb4f6518479fc408a7abd0e6"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra6119c0cdfccf051a846fa11b61364f5df9e7db93c310706a947f86a%40%3Cdev.netbeans.apache.org%3E"}],"affected":[{"package":{"name":"org.netbeans.html:pom","ecosystem":"Maven","purl":"pkg:maven/org.netbeans.html/pom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1"}]}],"versions":["0.7","0.7.1","0.7.5","0.7.6","0.8","0.8.1","0.8.2","0.8.3","0.9","1.0","1.1","1.2","1.2.1","1.2.2","1.2.3","1.3","1.4","1.5","1.5.1","1.6","1.6.1","1.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-ppc3-fpvh-7396/GHSA-ppc3-fpvh-7396.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}