Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2023-32190

mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE openSUSE Tumbleweed

Default version status: unaffected

  • ? to < 0.26-37.1affected

References