libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libqbUpgrade libqb-debuginfoUpgrade libqb-devel | Aug 6, 2021 | Jun 7, 2019 |
| Centos_linux | — | Upgrade libqb-develUpgrade libqb-debugsourceUpgrade libqbUpgrade libqb-debuginfoUpgrade libqb-tests-debuginfo | Nov 6, 2019 | Jun 7, 2019 |
| Debian | — | Upgrade libqb | Jul 30, 2024 | Jun 7, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/libqb. | Jul 5, 2021 | Jun 7, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libqb-develUpgrade libqb | Aug 31, 2020 | Jun 7, 2019 |
| Oracle_linux | — | Upgrade libqbUpgrade libqb-devel | Oct 5, 2022 | Apr 3, 2019 |
| Redhat_linux | — | Upgrade libqbUpgrade libqb-tests-debuginfoUpgrade libqb-debugsourceUpgrade libqb-develNo solution existsUpgrade libqb-debuginfo | Nov 6, 2019 | Jun 7, 2019 |
| Suse | — | Upgrade libqb0Upgrade libdlmUpgrade libqb-devel-64bitUpgrade libqb-testsUpgrade libdlm3Upgrade libdlm-develUpgrade libqb-toolsUpgrade libqb-develUpgrade libqb20-64bitUpgrade libqb20-32bitUpgrade libqb20Upgrade libqb-devel-32bitUpgrade libqb0-32bit | Jul 11, 2019 | Jun 7, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub