CVE-2019-12439

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00028.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00015.html
• https://access.redhat.com/errata/RHSA-2019:1833
• https://bugzilla.redhat.com/show_bug.cgi?id=1695963Issue Tracking, Third Party Advisory
• https://github.com/projectatomic/bubblewrap/commit/efc89e3b939b4bde42c10f065f6b7b02958ed50ePatch, Third Party Advisory
• https://github.com/projectatomic/bubblewrap/issues/304Third Party Advisory
• https://github.com/projectatomic/bubblewrap/releases/tag/v0.3.3Release Notes, Third Party Advisory
• https://security.gentoo.org/glsa/202006-18
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00028.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00015.html
• https://access.redhat.com/errata/RHSA-2019:1833
• https://bugzilla.redhat.com/show_bug.cgi?id=1695963Issue Tracking, Third Party Advisory
• https://github.com/projectatomic/bubblewrap/commit/efc89e3b939b4bde42c10f065f6b7b02958ed50ePatch, Third Party Advisory
• https://github.com/projectatomic/bubblewrap/issues/304Third Party Advisory
• https://github.com/projectatomic/bubblewrap/releases/tag/v0.3.3Release Notes, Third Party Advisory
• https://security.gentoo.org/glsa/202006-18

Published

May 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12432An issue was discovered in GitLab Community and Enterprise E…4.3
• CVE-2019-12433An issue was discovered in GitLab Community and Enterprise E…5.3
• CVE-2019-12434An issue was discovered in GitLab Community and Enterprise E…4.3
• CVE-2019-12435Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL…
• CVE-2019-12436Samba 4.10.x before 4.10.5 has a NULL pointer dereference, l…
• CVE-2019-12437In SilverStripe through 4.3.3, the previous fix for SS-2018-…8.8
• CVE-2019-1244An information disclosure vulnerability exists when DirectWr…6.5
• CVE-2019-12440The Sitecore Rocks plugin before 2.1.149 for Sitecore allows…
• CVE-2019-12441An issue was discovered in GitLab Community and Enterprise E…7.5
• CVE-2019-12442An issue was discovered in GitLab Enterprise Edition 11.7 th…6.1
• CVE-2019-12443An issue was discovered in GitLab Community and Enterprise E…9.8
• CVE-2019-12444An issue was discovered in GitLab Community and Enterprise E…6.1