CVE-2019-11675

The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga
ownership to the groonga account, which might let local users obtain root
access because of unsafe interaction with logrotate. For example, an
attacker can exploit a race condition to insert a symlink from
/var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in
the Debian packaging of the Groonga HTTP server.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928304&gt;