CVE-2014-1639

CVE-2014-1639 describes a local privilege escalation vulnerability in syncevolution prior to version 1.3.99.7, specifically within the syncevo/installcheck-local.sh script. The script's use of mktemp, followed by appending a suffix and writing to the new filename, creates a symlink attack vector. This allows a local attacker to overwrite arbitrary files on the system. The vulnerability has a CVSS score of 3.3, indicating a low severity with local access and medium attack complexity, resulting in partial integrity and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.