nvidia-cg-toolkit-installer in nvidia-cg-toolkit 2.0.0015 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvidia-cg-toolkit-manifest temporary file.
{ "binaries": [ { "binary_name": "libcg", "binary_version": "3.1.0013-5build1" }, { "binary_name": "libcggl", "binary_version": "3.1.0013-5build1" }, { "binary_name": "nvidia-cg-dev", "binary_version": "3.1.0013-5build1" }, { "binary_name": "nvidia-cg-toolkit", "binary_version": "3.1.0013-5build1" } ] }
{ "binaries": [ { "binary_name": "libcg", "binary_version": "3.1.0013-5build1" }, { "binary_name": "libcggl", "binary_version": "3.1.0013-5build1" }, { "binary_name": "nvidia-cg-dev", "binary_version": "3.1.0013-5build1" }, { "binary_name": "nvidia-cg-toolkit", "binary_version": "3.1.0013-5build1" } ] }