CVE-2019-12439

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point

High · published May 29, 2019

CVSS v3.0
7.4
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AC:H/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Published
2019-05-29T14:42Z
EPSS history
Timeline
  • 29 MAY 14:42Z
    bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point
    cvelistv5