CVE-2022-40299

    Dashboard / Vulnerabilities / CVE-2022-40299

    CVE-2022-40299

    Published: 9 Sept 2022Last Modified: 12 Aug 2026

    Summary:

    Details: In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language.

    References: http://michael.orlitzky.com/cves/cve-2022-40299.xhtml, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40299.json, https://nvd.nist.gov/vuln/detail/CVE-2022-40299, https://github.com/Singular/Singular/issues/1137, https://github.com/Singular/Singular/commit/5f28fbf066626fa9c4a8f0e6408c0bb362fb386c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -13640e8c400cbee504e7e26868152daf7c464261

    Affected versions

    Release-4-3-0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-40299 | CVE-DB