PT-2019-12797 · Project Bubblewrap+2 · Bubblewrap+2

Ret2Libc · Publicado 2019-05-29 · Atualizado 2024-06-15 · CVE-2019-12439

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bubblewrap versions prior to 0.3.3

Description The issue arises from the misuse of temporary directories in /tmp as a mount point by bubblewrap.c in Bubblewrap. In specific configurations related to XDG RUNTIME DIR, a local attacker may exploit this flaw to prevent other users from executing bubblewrap or potentially execute code.

Recommendations For versions prior to 0.3.3, update to version 0.3.3 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2019-1938

ALT-PU-2019-2266

CVE-2019-12439

OPENSUSE-SU-2019:1535-1

OPENSUSE-SU-2019:1721-1

OPENSUSE-SU-2019_1535-1

OPENSUSE-SU-2019_1721-1

OPENSUSE-SU-2024:10663-1

RHSA-2019:1833

SUSE-SU-2019:1826-1

SUSE-SU-2019_1826-1

Produtos afetados

Alt Linux

Suse

Bubblewrap

Referências · 26

• https://github.com/projectatomic/bubblewrap/commit/efc89e3b939b4bde42c10f065f6b7b02958ed50e · Correção
• https://github.com/projectatomic/bubblewrap/issues/304 · Nota
• https://github.com/projectatomic/bubblewrap/releases/tag/v0.3.3 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12439 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12439 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-12439 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-5226 · Nota
• https://security.gentoo.org/glsa/202006-18 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:1826-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12439 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12439 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00015.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-12439 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00028.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12439 · Aviso do Fabricante