CVE-2022-40299

Name	CVE-2022-40299
Description	In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
singular (PTS)	buster	1:4.1.1-p2+ds-3	vulnerable
	bullseye	1:4.1.1-p2+ds-4	vulnerable
	bookworm	1:4.3.1-p3+ds-2	vulnerable
	trixie	1:4.3.2-p10+ds-1	vulnerable
	sid	1:4.3.2-p16+ds-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
singular	source	experimental	1:4.3.1-p1+ds-1
singular	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/Singular/Singular/commit/5f28fbf066626fa9c4a8f0e6408c0bb362fb386c (Release-4-3-1)
https://github.com/Singular/Singular/issues/1137
Neutralised by kernel hardening (fs.protected_symlinks = 1)