libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libqb-develUpgrade libqbUpgrade libqb-debuginfo | Aug 6, 2021 | Jun 7, 2019 |
| Centos_linux | — | Upgrade libqb-debuginfoUpgrade libqb-tests-debuginfoUpgrade libqb-debugsourceUpgrade libqb-develUpgrade libqb | Nov 6, 2019 | Jun 7, 2019 |
| Debian | — | Upgrade libqb | Jul 30, 2024 | Jun 7, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/libqb. | Jul 5, 2021 | Jun 7, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libqb-develUpgrade libqb | Aug 31, 2020 | Jun 7, 2019 |
| Oracle_linux | — | Upgrade libqb-develUpgrade libqb | Oct 5, 2022 | Apr 3, 2019 |
| Redhat_linux | — | Upgrade libqb-debugsourceUpgrade libqbUpgrade libqb-tests-debuginfoUpgrade libqb-develUpgrade libqb-debuginfoNo solution exists | Nov 6, 2019 | Jun 7, 2019 |
| Suse | — | Upgrade libdlm-develUpgrade libdlmUpgrade libdlm3Upgrade libqb-testsUpgrade libqb-toolsUpgrade libqb-develUpgrade libqb-devel-64bitUpgrade libqb0Upgrade libqb-devel-32bitUpgrade libqb20-64bitUpgrade libqb0-32bitUpgrade libqb20-32bitUpgrade libqb20 | Jul 11, 2019 | Jun 7, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub