CVE-2023-32190

Publication date 16 October 2024

Last updated 23 October 2024

Ubuntu priority

Medium

Why this priority?

mlocate’s %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.

Read the notes from the security team

Status

Package Ubuntu Release Status
mlocate 24.10 oracular Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Notes

mdeslaur

the vulberable systemd script that does the chown isn’t in the Ubuntu package. Marking as not-affected.