CVE-2019-12779

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

• CWE-59

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00031.html
• http://www.securityfocus.com/bid/108691Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3610
• https://bugzilla.redhat.com/show_bug.cgi?id=1695948Exploit, Patch, Third Party Advisory, VDB Entry
• https://github.com/ClusterLabs/libqb/issues/338Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4Release Notes, Third Party Advisory
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5Release Notes, Third Party Advisory
• https://security.gentoo.org/glsa/202107-03
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00031.html
• http://www.securityfocus.com/bid/108691Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3610
• https://bugzilla.redhat.com/show_bug.cgi?id=1695948Exploit, Patch, Third Party Advisory, VDB Entry
• https://github.com/ClusterLabs/libqb/issues/338Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4Release Notes, Third Party Advisory
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5Release Notes, Third Party Advisory
• https://security.gentoo.org/glsa/202107-03

Published

Jun 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12771Command injection is possible in ThinStation through 6.1.1 v…
• CVE-2019-12773An issue was discovered in Verint Impact 360 15.1. At wfo/he…6.1
• CVE-2019-12774A number of stored XSS vulnerabilities have been identified …
• CVE-2019-12775An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
• CVE-2019-12776An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
• CVE-2019-12777An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
• CVE-2019-1278An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-12780The Belkin Wemo Enabled Crock-Pot allows command injection i…
• CVE-2019-12781An issue was discovered in Django 1.11 before 1.11.22, 2.1 b…
• CVE-2019-12782An authorization bypass vulnerability in pinboard updates in…
• CVE-2019-12783An issue was discovered in Verint Impact 360 15.1. At wfo/co…6.1
• CVE-2019-12784An issue was discovered in Verint Impact 360 15.1. At wfo/co…8.8