libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libqbUpgrade libqb-develUpgrade libqb-debuginfo | Aug 6, 2021 | Jun 7, 2019 |
| Centos_linux | — | Upgrade libqb-debugsourceUpgrade libqbUpgrade libqb-develUpgrade libqb-tests-debuginfoUpgrade libqb-debuginfo | Nov 6, 2019 | Jun 7, 2019 |
| Debian | — | Upgrade libqb | Jul 30, 2024 | Jun 7, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/libqb. | Jul 5, 2021 | Jun 7, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libqbUpgrade libqb-devel | Aug 31, 2020 | Jun 7, 2019 |
| Oracle_linux | — | Upgrade libqb-develUpgrade libqb | Oct 5, 2022 | Apr 3, 2019 |
| Redhat_linux | — | Upgrade libqbUpgrade libqb-tests-debuginfoUpgrade libqb-debugsourceNo solution existsUpgrade libqb-develUpgrade libqb-debuginfo | Nov 6, 2019 | Jun 7, 2019 |
| Suse | — | Upgrade libqb-devel-32bitUpgrade libqb20Upgrade libqb20-64bitUpgrade libqb20-32bitUpgrade libqb0-32bitUpgrade libdlm-develUpgrade libqb-devel-64bitUpgrade libqb-testsUpgrade libdlmUpgrade libqb-toolsUpgrade libdlm3Upgrade libqb-develUpgrade libqb0 | Jul 11, 2019 | Jun 7, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub