Product

Ubuntu 18.04 LTS

1 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 17, 2026 · last 1d ago

Timeline1 articles

USN-8779-1: Bubblewrap vulnerabilities

Ubuntu fixed two Bubblewrap flaws, CVE-2019-12439 and CVE-2026-87766, enabling local denial of service, code execution, or sandbox-escaped file creation.

USN-8779-1 fixes CVE-2019-12439, incorrect temporary directory handling in Bubblewrap that could allow local denial of service or arbitrary code execution, affecting only Ubuntu 18.04 LTS. It also addresses CVE-2026-87766, incorrect symlink handling during sandbox setup that lets local attackers create files outside the sandbox.

Ubuntu Security Noticesupdated 10:37 UTC · 6h agofirst Sep 17, 15:50 UTC · 1d agoAdvisory 19 sources CVE-2019-12439 CVE-2026-87766

Related CVEsby mentions

CVE-2026-877668.8<1%
Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0
CVE-2026-87766 is a symlink-following flaw (CWE-59) in bubblewrap, the Linux sandboxing tool: during sandbox setup, when bubblewrap creates files or directories under the new root, it can follow a parent symlink through /oldroot onto the host filesystem. The attack is triggered locally (CVSS AV:L/PR:L) before the sandboxed process starts, by an attacker with low privileges who can influence the sandbox setup, for example a sandboxed application being launched or a nested-bwrap scenario, so that writes land at attacker-chosen paths outside the sandbox. The attacker gains the ability to create or overwrite files and directories on the host with the privileges of the user launching the sandbox, breaking the sandbox boundary (CVSS scope-changed, S:C, with high confidentiality, integrity and availability impact; 8.8 High). Any Linux system running bubblewrap versions prior to 0.12.0 is affected, notably desktop distributions where bubblewrap is pulled in as a Flatpak dependency and other tooling that invokes bwrap for sandboxing. No exploitation is currently known: the flaw is not in CISA KEV, no public proof-of-concept is known, and the issue (GHSA-pxhw-h44j-8pfx, assigned by Red Hat) is fixed upstream in bubblewrap 0.12.0.
· bubblewrap project (freedesktop.org) bubblewrap all versions prior to 0.12.0mass
CVE-2019-124397.8<1%
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point.
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
· projectatomic bubblewrap—

Appears with

product Bubblewrap 1 vendor Canonical 1 vendor Ubuntu 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.