ALT-PU-2019-1914-1
Closed vulnerabilities
Published: 2019-06-07
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2019-12779
libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
Severity: HIGH (7.1)
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
References:
- openSUSE-SU-2019:1718
- openSUSE-SU-2019:1718
- openSUSE-SU-2019:1752
- openSUSE-SU-2019:1752
- openSUSE-SU-2019:1891
- openSUSE-SU-2019:1891
- 108691
- 108691
- RHSA-2019:3610
- RHSA-2019:3610
- https://bugzilla.redhat.com/show_bug.cgi?id=1695948
- https://bugzilla.redhat.com/show_bug.cgi?id=1695948
- https://github.com/ClusterLabs/libqb/issues/338
- https://github.com/ClusterLabs/libqb/issues/338
- https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4
- https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4
- https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5
- https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5
- GLSA-202107-03
- GLSA-202107-03