Vulnerability Description
SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation because any user can replace a /tmp/sqliteodbc$$ file with new contents that cause loading of an arbitrary library.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Backports Sle | 15.0 |
| Fedoraproject | Fedora | 30 |
| Sqliteodbc Project | Sqliteodbc | 0.9996 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00013.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00026.html
- http://www.ch-werner.de/sqliteodbc/Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1825762Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://sysdream.com/news/lab/Third Party Advisory
- https://sysdream.com/news/lab/2020-05-25-cve-2020-12050-fedora-red-hat-centos-lo
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00013.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00026.html
- http://www.ch-werner.de/sqliteodbc/Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1825762Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2020-12050?
CVE-2020-12050 is a vulnerability with a CVSS score of 7.0 (HIGH). SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation because any user can replace a /tmp/sqliteodbc$$ file with new con...
How severe is CVE-2020-12050?
CVE-2020-12050 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-12050?
Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Backports Sle, Fedoraproject Fedora, Sqliteodbc Project Sqliteodbc.