Red Hat Security AdvisoryRHSA-2020:1189
libqb security update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libqb-1.0.1-9.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libqb-devel-1.0.1-9.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) libqb-1.0.1-9.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libqb-devel-1.0.1-9.el7
- Red Hat Enterprise Linux Server (v. 7) libqb-1.0.1-9.el7, libqb-1.0.1-9.el7.ppc, libqb-devel-1.0.1-9.el7
- Red Hat Enterprise Linux Server Optional (v. 7) libqb-devel-1.0.1-9.el7, libqb-devel-1.0.1-9.el7.ppc
- Red Hat Enterprise Linux Workstation (v. 7) libqb-1.0.1-9.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) libqb-devel-1.0.1-9.el7
Fixes 1 record
Priority LOW 32
libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS 3.0HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00655 · Published 2019-06-07 · Partial fix CWE-59
