CVE-2017-11747

CVE-2017-11747 affects Tinyproxy versions 1.8.4 and earlier, where a race condition allows a local, low-privileged attacker to kill arbitrary processes. The vulnerability arises because Tinyproxy creates its PID file after dropping root privileges, enabling an attacker with access to the non-root Tinyproxy account to modify the PID file before a root script attempts to kill the process ID specified within. This is a medium severity vulnerability (CVSS 5.5) with low attack complexity, requiring local access and user interaction to achieve high availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.