SageMath FlintQS 1.0 relies on pathnames under TMPDIR (typically world-writable), which (for example) allows a local user to overwrite files with the privileges of a different user (who is running FlintQS).
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Flintqs | Sagemath | 1.0 (including) | 1.0 (including) |
| Flintqs | Ubuntu | bionic | * |
| Flintqs | Ubuntu | focal | * |
| Flintqs | Ubuntu | kinetic | * |
| Flintqs | Ubuntu | lunar | * |
| Flintqs | Ubuntu | mantic | * |
| Flintqs | Ubuntu | oracular | * |
| Flintqs | Ubuntu | plucky | * |
| Flintqs | Ubuntu | trusty | * |
| Flintqs | Ubuntu | xenial | * |