debian/libqb vulnerabilities

Latest debian/libqb CVEs

Newest publication first

1. CVE-2023-39976 log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

   Published 2023-08-08

   Critical·CVSS 9.8 EPSS 1.2%

   log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

2. CVE-2019-12779 libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

   Published 2019-06-07

   High·CVSS 7.1 EPSS 0.66%

   libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.