CVE-2019-13227: In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root,...

Security readout for executives and security teams

deepin-clone before 1.1.3 can let a local unprivileged user abuse a predictable temporary log path when the GUI runs as root. The issue can create or overwrite arbitrary files, although the attacker does not control the written content. Exposure is limited to Linux systems with vulnerable deepin-clone installed, especially shared desktops or multi-user systems where local users can access /tmp and the GUI is launched with root privileges. Treat this as a targeted local hardening issue, not an internet-wide emergency. Prioritize shared Linux workstations, lab systems, and administrator desktops where local users may coexist. Mitigation focus: Upgrade deepin-clone to version 1.1.3 or a vendor-patched package.; Check distribution advisories for the exact fixed package version.; Avoid running vulnerable deepin-clone GUI mode on shared systems until patched..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.