CVE-2016-10330

Description

Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.

Weakness classification

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

• security@synology.com — Exploit, Third Party Advisory, VDB Entry
• security@synology.com — Exploit, Third Party Advisory
• security@synology.com — Exploit, Third Party Advisory
• security@synology.com — Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes