bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8779-1 advisory.

    It was discovered that Bubblewrap incorrectly handled certain temporary directories. A local attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only     affected Ubuntu 18.04 LTS. (CVE-2019-12439)

    It was discovered that Bubblewrap incorrectly handled certain symlinks during sandbox setup. A local     attacker could possibly use this issue to create files outside of the sandbox. (CVE-2026-87766)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some     particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent     other users from executing bubblewrap or potentially execute code. (CVE-2019-12439)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1833 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * bubblewrap: temporary directory misuse as mount point (CVE-2019-12439)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the bubblewrap package has been released.

The remote host is affected by the vulnerability described in GLSA-202006-18 (Bubblewrap: Arbitrary code execution)

    Bubblewrap misuses temporary directories in /tmp as a mount point.
  Impact :

    This flaw may allow possible execution of code or prevention of running       Bubblewrap.
  Workaround :

    There is no known workaround at this time.

According to the version of the bubblewrap package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - bubblewrap.c in Bubblewrap before 0.3.3 misuses     temporary directories in /tmp as a mount point. In some     particular configurations (related to XDG_RUNTIME_DIR),     a local attacker may abuse this flaw to prevent other     users from executing bubblewrap or potentially execute     code.(CVE-2019-12439)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bubblewrap fixes the following issues :

Security issue fixed :

  - CVE-2019-12439: Fixed insecure use of /tmp     (bsc#1136958).

This update was imported from the SUSE:SLE-15:Update update project.

This update for bubblewrap fixes the following issues :

Security issue fixed :

CVE-2019-12439: Fixed insecure use of /tmp (bsc#1136958).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bubblewrap to version 0.3.3 fixes the following issue:
&#9; Security issue fixed :

  - CVE-2019-12439: Fixed a temporary directory misuse as     mount point which could have allowed local user to     prevent others from running bubblewrap.

ID	Name	Product	Family	Type	Severity
348242	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Bubblewrap vulnerabilities (USN-8779-1)	Nessus	Ubuntu Local Security Checks	Local	high
222559	Linux Distros Unpatched Vulnerability : CVE-2019-12439	Nessus	Misc.	Local	high
210538	RHEL 7 : CloudForms 4.7.7 (RHSA-2019:1833)	Nessus	Red Hat Local Security Checks	Local	high
202850	Photon OS 2.0: Bubblewrap PHSA-2019-2.0-0163	Nessus	PhotonOS Local Security Checks	Local	high
137455	GLSA-202006-18 : Bubblewrap: Arbitrary code execution	Nessus	Gentoo Local Security Checks	Local	high
129239	EulerOS 2.0 SP3 : bubblewrap (EulerOS-SA-2019-2046)	Nessus	Huawei Local Security Checks	Local	high
126999	EulerOS 2.0 SP8 : bubblewrap (EulerOS-SA-2019-1762)	Nessus	Huawei Local Security Checks	Local	high
126887	openSUSE Security Update : bubblewrap (openSUSE-2019-1721)	Nessus	SuSE Local Security Checks	Local	high
126690	SUSE SLED15 / SLES15 Security Update : bubblewrap (SUSE-SU-2019:1826-1)	Nessus	SuSE Local Security Checks	Local	high
126191	Photon OS 3.0: Bubblewrap PHSA-2019-3.0-0019	Nessus	PhotonOS Local Security Checks	Local	high
125810	openSUSE Security Update : bubblewrap (openSUSE-2019-1535)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2019-12439

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high