Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-87766 →

DEBIAN-CVE-2026-87766

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 bubblewrap

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 bubblewrap

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1~deb13u1"}]}]

Debian:14 bubblewrap

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1"}]}]

Références

advisory security-tracker.debian.org