Every CVE Search/ Get API key

CVE-2019-12779

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because...

7.1 HighFix available

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.66%Down 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
CVE-2019-12779
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0
6.6 MediumAV:L/AC:L/Au:N/C:N/I:C/A:C
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
CVE-2019-12779
Updated
2026-11-02
EUVDEUVD-2019-4363 No score

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
EUVD-2019-4363
Updated
2026-11-03
GitHub AdvisoriesGHSA-wc62-h53h-g8qf 7.1

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because...

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
GHSA-wc62-h53h-g8qf
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-59
Updated
2026-11-02
OSV 7.1

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
CVE-2019-12779
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-12779 7.1

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
DEBIAN-CVE-2019-12779
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2021-1141 7.1

libqb security update

libqb provides high-performance, reusable features for client-server architecture, such as logging, tracing, inter-process communication (IPC), and polling.

Security Fix(es):

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.(CVE-2019-12779)

Record
OESA-2021-1141
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3610 6.5

Red Hat Security Advisory: libqb security and bug fix update

Record
RHSA-2019:3610
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2020:1189 6.5

Red Hat Security Advisory: libqb security update

Record
RHSA-2020:1189
CVSS 3.0
6.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-12779 7.1

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Record
UBUNTU-CVE-2019-12779
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0048 No score

Updated libqb packages fix security vulnerability

Insecure treatment of IPC temporary files which could allow a local attacker to overwrite privileged system files (CVE-2019-12779).

Record
MGASA-2020-0048
Updated
2026-11-02
OSVopenSUSE-SU-2019:1718-1 No score

Security update for libqb

This update for libqb fixes the following issues:

Security issue fixed:

  • CVE-2019-12779: Fixed an issue where a local attacker could overwrite privileged system files (bsc#1137835).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1718-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1752-1 No score

Security update for libqb

This update for libqb fixes the following issue:

Security issue fixed:

  • CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2019:1752-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1891-1 No score

Security update for libqb

This update for libqb fixes the following issue:

Security issue fixed:

  • CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835).

This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2019:1891-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10974-1 No score

doxygen2man-2.0.2+20201203.def947e-1.6 on GA media

These are all security issues fixed in the doxygen2man-2.0.2+20201203.def947e-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10974-1
Updated
2026-11-02
OSVSUSE-SU-2019:1791-1 No score

Security update for libqb

This update for libqb fixes the following issue:

Security issue fixed:

  • CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835).
Record
SUSE-SU-2019:1791-1
Updated
2026-11-02
OSVSUSE-SU-2019:1806-1 No score

Security update for libdlm, libqb

This update for libdlm, libqb fixes the following issues:

libqb to version 1.0.3:

  • CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835).
  • Enabled use of filesystem sockets for linux (fate#323415).
  • Fixed logging with newer binutils version (bsc#1074327).

libdlm:

  • Explicitly used and linked libstonithd from libpacemaker3 (bsc#1098449).
Record
SUSE-SU-2019:1806-1
Updated
2026-11-02
OSVSUSE-SU-2019:1812-1 No score

Security update for libqb

This update for libqb fixes the following issues:

Security issue fixed:

  • CVE-2019-12779: Fixed an issue where a local attacker could overwrite privileged system files (bsc#1137835).
Record
SUSE-SU-2019:1812-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libqb
Debian:12
 before 1.0.4-1
1.0.4-1
libqb
Debian:13
 before 1.0.4-1
1.0.4-1
libqb
Debian:14
 before 1.0.4-1
1.0.4-1
libqb
Mageia:7
 before 1.0.5-1.mga7
1.0.5-1.mga7
libqb
openEuler:20.03-LTS-SP1
 before 1.0.3-7.oe1
1.0.3-7.oe1
libqb
Red Hat:enterprise_linux:8::baseos
 before 0:1.0.3-10.el8
0:1.0.3-10.el8
libqb-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.0.3-10.el8
0:1.0.3-10.el8
libqb-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.0.3-10.el8
0:1.0.3-10.el8
libqb-devel
Red Hat:enterprise_linux:8::baseos
 before 0:1.0.3-10.el8
0:1.0.3-10.el8
libqb-tests-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.0.3-10.el8
0:1.0.3-10.el8
Show 26 moreShow less
Affected packages
PackageAffectedFixed
libqb
Red Hat:enterprise_linux:7::client
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-devel
Red Hat:enterprise_linux:7::client
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb
Red Hat:enterprise_linux:7::server
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-devel
Red Hat:enterprise_linux:7::server
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.1-9.el7
0:1.0.1-9.el7
libqb
SUSE:Linux Enterprise High Availability Extension 15 SP1
 before 1.0.3+20190326.a521604-3.3.1
1.0.3+20190326.a521604-3.3.1
libdlm
SUSE:Linux Enterprise High Availability Extension 12 SP3
 before 4.0.7-3.3.2
4.0.7-3.3.2
libqb
SUSE:Linux Enterprise High Availability Extension 12 SP3
 before 1.0.3+20171226.6d62b64-4.3.1
1.0.3+20171226.6d62b64-4.3.1
libdlm
SUSE:Linux Enterprise High Availability Extension 12 SP4
 before 4.0.7-3.3.2
4.0.7-3.3.2
libqb
SUSE:Linux Enterprise High Availability Extension 12 SP4
 before 1.0.3+20171226.6d62b64-4.3.1
1.0.3+20171226.6d62b64-4.3.1
libdlm
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 4.0.7-3.3.2
4.0.7-3.3.2
libqb
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 1.0.3+20171226.6d62b64-4.3.1
1.0.3+20171226.6d62b64-4.3.1
libqb
SUSE:Linux Enterprise High Availability Extension 15
 before 1.0.3+20171226.6d62b64-3.3.1
1.0.3+20171226.6d62b64-3.3.1
libqb
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.16.0.real-1ubuntu20.16.0.real-1ubuntu30.16.0.real-1ubuntu40.16.0.real-1ubuntu5
 None known
libqb
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.17.0-2ubuntu10.17.2.real-4ubuntu10.17.2.real-6ubuntu1
 None known
libqb
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.0.1-1ubuntu1
 None known
libqb
openSUSE:Leap 15.0
 before 1.0.3+20171226.6d62b64-lp150.2.3.1
1.0.3+20171226.6d62b64-lp150.2.3.1
libqb
openSUSE:Leap 15.1
 before 1.0.3+20190326.a521604-lp151.2.3.1
1.0.3+20190326.a521604-lp151.2.3.1
libqb
SUSE:Package Hub 15 SP1
 before 1.0.3+20190326.a521604-bp151.2.3.1
1.0.3+20190326.a521604-bp151.2.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-12779 is a high vulnerability (CVSS 7.1) in Clusterlabs Libqb, published June 7, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in libqb 1.0.4-1.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open