[CLSA-2026:1789985660] Fix CVE(s): CVE-2019-12439

Type:

security

Severity:

Important

Release date:

2026-09-21 15:55:29 UTC

Description:

   * SECURITY UPDATE: DoS / symlink attack via the attacker-precreatable
     pivot_root mount point
     - debian/patches/CVE-2019-12439.patch: mount the root tmpfs on /tmp itself
       in main() (bubblewrap.c) instead of creating /run/user/$UID/.bubblewrap
       or /tmp/.bubblewrap-$UID, which another local user can pre-create as a
       non-directory or as a symlink they control
     - debian/patches/CVE-2019-12439-test.patch: upstream regression test for
       the above, asserting the pivot_root scaffolding (/tmp/oldroot,
       /tmp/newroot) stays invisible inside the container (tests/test-run.sh)
     - CVE-2019-12439

CVEs fixed:

CVE-2019-12439

Updated packages:

bubblewrap_0.2.1-1ubuntu0.1+tuxcare.els1_amd64.deb
sha:71ed8de285a993556f1f70206042796ee71358e0

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.