Input validation error in Bubblewrap - CVE-2019-12439
Published: June 4, 2019
Vulnerability identifier: #VU18666
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-12439
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due due to the insecure use of the /tmp directory by the bubblewrap.c source code file of the affected software. A local attacker can execute arbitrary code or cause a (DoS) attack by preventing other users from executing bubblewrap from executing the affected application.
Affected software
Bubblewrap
Gentoo Linux
Opensuse
Ubuntu
bubblewrap (Ubuntu package)
Gentoo Linux
Opensuse
Ubuntu
bubblewrap (Ubuntu package)
How to mitigate CVE-2019-12439
Install updates from vendor's website.
Bubblewrap - update to 0.3.3
bubblewrap (Ubuntu package) - addressed in versions 0.2.1-1ubuntu0.1+esm2, 0.2.1-1ubuntu0.1+esm3, 0.4.0-1ubuntu4.1+esm2, 0.4.0-1ubuntu4.1+esm3, 0.6.1-1ubuntu0.2, 0.9.0-1ubuntu0.2, 0.11.1-1ubuntu0.2
bubblewrap (Ubuntu package) - addressed in versions 0.2.1-1ubuntu0.1+esm2, 0.2.1-1ubuntu0.1+esm3, 0.4.0-1ubuntu4.1+esm2, 0.4.0-1ubuntu4.1+esm3, 0.6.1-1ubuntu0.2, 0.9.0-1ubuntu0.2, 0.11.1-1ubuntu0.2