USN-8779-2: Bubblewrap regression
Ubuntu issued USN-8779-2 reverting a Bubblewrap symlink fix for CVE-2026-87766 that caused a regression preventing some Flatpak apps from launching.
32
CVE-2019-12439
- CVSS 3.0
- 7.8 high
- EPSS
- <1%p41
- Published
- ·
- Modified
Description · NVD
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
- Vendors
- projectatomic
- Products
- bubblewrap
- Weakness
- CWE-20
- Vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesUSN-8779-1: Bubblewrap vulnerabilities
Ubuntu fixed two Bubblewrap flaws, CVE-2019-12439 and CVE-2026-87766, enabling local denial of service, code execution, or sandbox-escaped file creation.
30