CVE-2008-4440: Debian Feta

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

The to-upgrade plugin in feta 1.4.16 allows local users to overwrite arbitrary files via a symlink on the (1) /tmp/feta.install.$USER and (2) /tmp/feta.avail.$USER temporary files.

Affected products

• Debian Feta: any version

Published 2008-10-03. Last modified 2026-06-16.