Advisory Weakness Curation

Hub Package Arbitrary File Overwrite The `am` function in `lib/hub/commands.rb` in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.

Temporary Directory Insecure Permissions Local Symlink File Overwrite Since the `/tmp` directory is readable by everybody on Unix, and since the patch name could be public or easy to guess, an attacker could create a symlink to a file writable by the user running hub, which would be replaced by the patch.