CVE-2019-12875

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance of an untrusted signing key.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-668 CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://code.foxkit.us/adelie/packages/commit/15b160780c6eeff7048063c099a7f8757e1d8391Patch, Third Party Advisory
https://github.com/sroracle/abuild/commit/4f90ce92778d0ee302e288def75591b96a397c8bPatch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190625-0005/
https://code.foxkit.us/adelie/packages/commit/15b160780c6eeff7048063c099a7f8757e1d8391Patch, Third Party Advisory
https://github.com/sroracle/abuild/commit/4f90ce92778d0ee302e288def75591b96a397c8bPatch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190625-0005/

Timeline

Published: Jun 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-128767.3Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege CVE-2019-128804.3BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_accessible_resources. A CVE-2019-128817.8i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cau CVE-2019-128878.1KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).CVE-2019-128897.0An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon s CVE-2019-12895.5An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permission CVE-2019-128909.8RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.a CVE-2019-128937.5Alternate Pic View 2.600 has a User Mode Write AV starting at PicViewer!PerfgrapFinalize+0x00000000000a8868.CVE-2019-128947.5Alternate Pic View 2.600 has a Read Access Violation at the Instruction Pointer after a call from PicViewer!PerfgrapFinalize+0x00000000000a9 CVE-2019-128957.5In Alternate Pic View 2.600, the Exception Handler Chain is Corrupted starting at PicViewer!PerfgrapFinalize+0x00000000000b916d.CVE-2019-128967.5Edraw Max 7.9.3 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a77.CVE-2019-128977.5Edraw Max 7.9.3 has a Read Access Violation at the Instruction Pointer after a call from ObjectModule!Paint::Clear+0x0000000000000074.