Description
Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mumble | 1.2.3-3 | — |
| Debian 13 | mumble | 1.2.3-3 | — |
| Debian 12 | mumble | 1.2.3-3 | — |
| Debian 6.0 | mumble | 1.2.2-6+squeeze1 | DSA-2411-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mumble | 1.2.17-1.2 | openSUSE-SU-2024:10080-1 |
Advisories 2
- DSA-2411-1 mumble - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10080-1 mumble-1.2.17-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 52024 vdb-entry
- https://bugs.launchpad.net/ubuntu/+source/mumble/+bug/783405
- [oss-security] 20120215 Re: CVE request: mumble local information disclosure mailing-list
- https://github.com/mumble-voip/mumble/commit/5632c35d6759f5e13a7dfe78e4ee6403ff6a8e3e
- DSA-2411 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=403939
- https://bugzilla.redhat.com/show_bug.cgi?id=791000
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659039
- 47951 third-party-advisory
- [oss-security] 20120215 CVE request: mumble local information disclosure mailing-list