CVE-2019-12439 — Vulnerability intelligence

projectatomic — bubblewrap

Published: 2019-05-29T14:42:08.000Z

CVSS

7.4

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

Sources

• CVE-2019-12439
• Original advisory
• Issue Tracking, Third Party Advisory
• Patch, Third Party Advisory
• Third Party Advisory
• Release Notes, Third Party Advisory
• Original advisory
• CVE-2019-12439