CVE-2023-32190

mlocate: mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable

Loading…

Severity

Moderate

Red Hat Product Security

7.8

CVSS 3.1

Review impact separately from score.

Published · October 16, 2024

Updated · November 21, 2025

Description

A flaw was found in the mlocate package of OpenSUSE and derived distributions. This issue occurs due to a insecure chmod call in the %post section of the mlocate package, allowing users to obtain read/write access to arbitrary files on the system when the mlocate package is re-installed or upgraded.

Statement

This flaw is specific to OpenSUSE and derived distributions. Therefore, Red Hat products are not affected by this issue.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-732 · Incorrect Permission Assignment for Critical Resource