libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libqbUpgrade libqb-debuginfoUpgrade libqb-devel | Aug 6, 2021 | Jun 7, 2019 |
| Centos_linux | — | Upgrade libqb-debuginfoUpgrade libqb-tests-debuginfoUpgrade libqb-develUpgrade libqbUpgrade libqb-debugsource | Nov 6, 2019 | Jun 7, 2019 |
| Debian | — | Upgrade libqb | Jul 30, 2024 | Jun 7, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/libqb. | Jul 5, 2021 | Jun 7, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libqbUpgrade libqb-devel | Aug 31, 2020 | Jun 7, 2019 |
| Oracle_linux | — | Upgrade libqbUpgrade libqb-devel | Oct 5, 2022 | Apr 3, 2019 |
| Redhat_linux | — | Upgrade libqb-tests-debuginfoUpgrade libqbUpgrade libqb-debugsourceUpgrade libqb-debuginfoUpgrade libqb-develNo solution exists | Nov 6, 2019 | Jun 7, 2019 |
| Suse | — | Upgrade libqb-develUpgrade libdlm3Upgrade libqb-devel-64bitUpgrade libqb-toolsUpgrade libqb0Upgrade libqb-testsUpgrade libdlmUpgrade libdlm-develUpgrade libqb20-32bitUpgrade libqb20Upgrade libqb20-64bitUpgrade libqb0-32bitUpgrade libqb-devel-32bit | Jul 11, 2019 | Jun 7, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 7, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub