bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

The remote host is affected by the vulnerability described in GLSA-202006-18 (Bubblewrap: Arbitrary code execution)

    Bubblewrap misuses temporary directories in /tmp as a mount point.
  Impact :

    This flaw may allow possible execution of code or prevention of running       Bubblewrap.
  Workaround :

    There is no known workaround at this time.

According to the version of the bubblewrap package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - bubblewrap.c in Bubblewrap before 0.3.3 misuses     temporary directories in /tmp as a mount point. In some     particular configurations (related to XDG_RUNTIME_DIR),     a local attacker may abuse this flaw to prevent other     users from executing bubblewrap or potentially execute     code.(CVE-2019-12439)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bubblewrap fixes the following issues :

Security issue fixed :

  - CVE-2019-12439: Fixed insecure use of /tmp     (bsc#1136958).

This update was imported from the SUSE:SLE-15:Update update project.

This update for bubblewrap fixes the following issues :

Security issue fixed :

CVE-2019-12439: Fixed insecure use of /tmp (bsc#1136958).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the bubblewrap package has been released.

This update for bubblewrap to version 0.3.3 fixes the following issue:
&#9; Security issue fixed :

  - CVE-2019-12439: Fixed a temporary directory misuse as     mount point which could have allowed local user to     prevent others from running bubblewrap.

ID	Name	Product	Family	Severity
137455	GLSA-202006-18 : Bubblewrap: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
129239	EulerOS 2.0 SP3 : bubblewrap (EulerOS-SA-2019-2046)	Nessus	Huawei Local Security Checks	high
126999	EulerOS 2.0 SP8 : bubblewrap (EulerOS-SA-2019-1762)	Nessus	Huawei Local Security Checks	high
126887	openSUSE Security Update : bubblewrap (openSUSE-2019-1721)	Nessus	SuSE Local Security Checks	high
126690	SUSE SLED15 / SLES15 Security Update : bubblewrap (SUSE-SU-2019:1826-1)	Nessus	SuSE Local Security Checks	high
126191	Photon OS 3.0: Bubblewrap PHSA-2019-3.0-0019	Nessus	PhotonOS Local Security Checks	high
125810	openSUSE Security Update : bubblewrap (openSUSE-2019-1535)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-12439

high

Tenable Plugins

high

high

high

high

high

high

high