libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libqb-debuginfoUpgrade libqb-develUpgrade libqb | Aug 6, 2021 | Jun 7, 2019 |
| Centos_linux | — | Upgrade libqb-develUpgrade libqbUpgrade libqb-debugsourceUpgrade libqb-tests-debuginfoUpgrade libqb-debuginfo | Nov 6, 2019 | Jun 7, 2019 |
| Debian | — | Upgrade libqb | Jul 30, 2024 | Jun 7, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/libqb. | Jul 5, 2021 | Jun 7, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libqbUpgrade libqb-devel | Aug 31, 2020 | Jun 7, 2019 |
| Oracle_linux | — | Upgrade libqb-develUpgrade libqb | Oct 5, 2022 | Apr 3, 2019 |
| Redhat_linux | — | No solution existsUpgrade libqb-debuginfoUpgrade libqb-develUpgrade libqb-tests-debuginfoUpgrade libqb-debugsourceUpgrade libqb | Nov 6, 2019 | Jun 7, 2019 |
| Suse | — | Upgrade libqb-develUpgrade libqb-devel-64bitUpgrade libqb0Upgrade libqb-toolsUpgrade libqb-testsUpgrade libdlmUpgrade libdlm-develUpgrade libdlm3Upgrade libqb20Upgrade libqb20-64bitUpgrade libqb-devel-32bitUpgrade libqb0-32bitUpgrade libqb20-32bit | Jul 11, 2019 | Jun 7, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub