Timeshift vulnerability

2020-03-3000:00:00

ubuntu.com

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

14.2%

JSON

Releases

Ubuntu 19.10

Packages

timeshift - System restore utility

Details

Matthias Gerstner discovered that Timeshift did not securely create temporary
files. An attacker could exploit a race condition in Timeshift and potentially
execute arbitrary commands as root.

OSVersionArchitecturePackageVersionFilename
Ubuntu19.10noarchtimeshift< 19.01+ds-2ubuntu0.1UNKNOWN
Ubuntu19.10noarchtimeshift-dbgsym< 19.01+ds-2ubuntu0.1UNKNOWN