CVE-2019-12439

2019-05-2915:29:00

Google

osv.dev

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

JSON

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

CPENameOperatorVersion
bubblewrapeq0.2.1
bubblewrapeq0.1.3
bubblewrapeq0.3.2
bubblewrapeq0.1.5
bubblewrapeq0.3.1
bubblewrapeq0.2.0
bubblewrapeq0.1.2
bubblewrapeq0.1.8
bubblewrapeq0.1.4
bubblewrapeq0.3.0

Name	Operator	Version
bubblewrap	eq	0.2.1
bubblewrap	eq	0.1.3
bubblewrap	eq	0.3.2
bubblewrap	eq	0.1.5
bubblewrap	eq	0.3.1
bubblewrap	eq	0.2.0
bubblewrap	eq	0.1.2
bubblewrap	eq	0.1.8
bubblewrap	eq	0.1.4
bubblewrap	eq	0.3.0