Vulnerability · Published Sep 9, 2022 · Assigned by mitre
CVE-2022-40299
High 7.8
In plain English
A high-severity security flaw in the singular package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 72.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | singular | no fix listed | DEBIAN-CVE-2022-40299 |
| Debian:13 | singular | no fix listed | DEBIAN-CVE-2022-40299 |
| Debian:14 | singular | no fix listed | DEBIAN-CVE-2022-40299 |
| Ubuntu:22.04:LTS | singular | no fix listed | UBUNTU-CVE-2022-40299 |
| Ubuntu:24.04:LTS | singular | no fix listed | UBUNTU-CVE-2022-40299 |
| Ubuntu:25.10 | singular | no fix listed | UBUNTU-CVE-2022-40299 |
| Ubuntu:26.04:LTS | singular | no fix listed | UBUNTU-CVE-2022-40299 |
| Ubuntu:26.10 | singular | no fix listed | UBUNTU-CVE-2022-40299 |
Affected products (as reported)
References
- https://github.com/Singular/Singular/issues/1137 x_refsource_MISC
- https://github.com/Singular/Singular/commit/5f28fbf066626fa9c4a8f0e6408c0bb362fb386c x_refsource_MISC
- http://michael.orlitzky.com/cves/cve-2022-40299.xhtml x_refsource_MISC