USN-8779-1: Bubblewrap vulnerabilities
Ubuntu fixed two Bubblewrap flaws, CVE-2019-12439 and CVE-2026-87766, enabling local denial of service, code execution, or sandbox-escaped file creation.
USN-8779-1 fixes CVE-2019-12439, incorrect temporary directory handling in Bubblewrap that could allow local denial of service or arbitrary code execution, affecting only Ubuntu 18.04 LTS. It also addresses CVE-2026-87766, incorrect symlink handling during sandbox setup that lets local attackers create files outside the sandbox.
- CVE-2019-12439: local DoS or arbitrary code execution, affects only Ubuntu 18.04 LTS.
- CVE-2026-87766: symlink mishandling lets local attackers create files outside the sandbox.
- Products
- BubblewrapUbuntu 18.04 LTS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-12439 | bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point | 7.8 | <1% | ||
| CVE-2026-87766 | Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0 | 8.8 | <1% |
From the original article
It was discovered that Bubblewrap incorrectly handled certain temporary directories. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.