CVE Daily – openSUSE (High+Critical) https://cvedaily.com/pages/tags/opensuse.html CVE Daily – openSUSE (High+Critical) en Wed, 03 Jun 2026 21:27:00 +0000 [High] CVE-2026-25701 – An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local use... https://nvd.nist.gov/vuln/detail/CVE-2026-25701 https://nvd.nist.gov/vuln/detail/CVE-2026-25701 Wed, 25 Feb 2026 12:16:17 +0000 High CVE-2026-25701

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in /var/lib/pcrlock.d * manipulate the data backed up in /tmp/pcrlock.d.bak, therefore violating the integrity of the data should it be restored. *  overwrite protected system files with data from…

CVSS: 7.0 · CWE: CWE-377

View on NVD

]]> [High] CVE-2025-46810 – A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openS... https://nvd.nist.gov/vuln/detail/CVE-2025-46810 https://nvd.nist.gov/vuln/detail/CVE-2025-46810 Tue, 02 Sep 2025 12:15:36 +0000 High CVE-2025-46810

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29.

CVSS: 8.5 · CWE: CWE-61

View on NVD

]]> [Critical] CVE-2025-23394 – A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cy... https://nvd.nist.gov/vuln/detail/CVE-2025-23394 https://nvd.nist.gov/vuln/detail/CVE-2025-23394 Mon, 26 May 2025 16:15:20 +0000 Critical CVE-2025-23394

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.

CVSS: 9.8 · CWE: CWE-61

View on NVD

]]> [High] CVE-2023-53052 – In the Linux kernel, the following vulnerability has been resolved: cifs: fix u... https://nvd.nist.gov/vuln/detail/CVE-2023-53052 https://nvd.nist.gov/vuln/detail/CVE-2023-53052 Fri, 02 May 2025 16:15:24 +0000 High CVE-2023-53052

In the Linux kernel, the following vulnerability has been resolved: cifs: fix use-after-free bug in refresh_cache_worker() The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require…

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2025-23386 – A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package... https://nvd.nist.gov/vuln/detail/CVE-2025-23386 https://nvd.nist.gov/vuln/detail/CVE-2025-23386 Thu, 10 Apr 2025 10:15:14 +0000 High CVE-2025-23386

A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before 2.5.0-1.1.

CVSS: 7.8 · CWE: CWE-276

View on NVD

]]> [High] CVE-2022-49412 – In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid ... https://nvd.nist.gov/vuln/detail/CVE-2022-49412 https://nvd.nist.gov/vuln/detail/CVE-2022-49412 Wed, 26 Feb 2025 07:01:17 +0000 High CVE-2022-49412

In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge (and set bic->stable_merge_bfqq) and the moment bfq_setup_merge() is called. This can happen e.g. because the process submitted IO for a different cgroup and thus bfqq got r…

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2024-46687 – In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... https://nvd.nist.gov/vuln/detail/CVE-2024-46687 https://nvd.nist.gov/vuln/detail/CVE-2024-46687 Fri, 13 Sep 2024 06:15:13 +0000 High CVE-2024-46687

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() [BUG] There is an internal report that KASAN is reporting use-after-free, with the following backtrace: BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs] Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45 C…

CVSS: 7.8 · CWE: CWE-415

View on NVD

]]> [High] CVE-2023-52751 – In the Linux kernel, the following vulnerability has been resolved: smb: client... https://nvd.nist.gov/vuln/detail/CVE-2023-52751 https://nvd.nist.gov/vuln/detail/CVE-2023-52751 Tue, 21 May 2024 16:15:14 +0000 High CVE-2023-52751

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2_query_info_compound() The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm' BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [ci…

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2023-52434 – In the Linux kernel, the following vulnerability has been resolved: smb: client... https://nvd.nist.gov/vuln/detail/CVE-2023-52434 https://nvd.nist.gov/vuln/detail/CVE-2023-52434 Tue, 20 Feb 2024 18:15:50 +0000 High CVE-2023-52434

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in ke…

CVSS: 8.0 · CWE: CWE-119

View on NVD

]]> [High] CVE-2023-32184 – A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-w... https://nvd.nist.gov/vuln/detail/CVE-2023-32184 https://nvd.nist.gov/vuln/detail/CVE-2023-32184 Tue, 19 Sep 2023 10:15:12 +0000 High CVE-2023-32184

A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.

CVSS: 7.8 · CWE: CWE-922

View on NVD

]]> [High] CVE-2023-32183 – Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 pac... https://nvd.nist.gov/vuln/detail/CVE-2023-32183 https://nvd.nist.gov/vuln/detail/CVE-2023-32183 Fri, 07 Jul 2023 09:15:10 +0000 High CVE-2023-32183

Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE Tumbleweed.

CVSS: 7.8 · CWE: CWE-276

View on NVD

]]> [High] CVE-2022-45153 – An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SU... https://nvd.nist.gov/vuln/detail/CVE-2022-45153 https://nvd.nist.gov/vuln/detail/CVE-2022-45153 Wed, 15 Feb 2023 10:15:16 +0000 High CVE-2022-45153

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formul…

CVSS: 7.0 · CWE: CWE-276

View on NVD

]]> [High] CVE-2022-31254 – A Incorrect Default Permissions vulnerability in rmt-server-regsharing service o... https://nvd.nist.gov/vuln/detail/CVE-2022-31254 https://nvd.nist.gov/vuln/detail/CVE-2022-31254 Tue, 07 Feb 2023 10:15:52 +0000 High CVE-2022-31254

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10.…

CVSS: 7.8 · CWE: CWE-276

View on NVD

]]> [High] CVE-2022-46163 – Travel support program is a rails app to support the travel support program of o... https://nvd.nist.gov/vuln/detail/CVE-2022-46163 https://nvd.nist.gov/vuln/detail/CVE-2022-46163 Tue, 10 Jan 2023 21:15:12 +0000 High CVE-2022-46163

Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, R…

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2022-31253 – A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows lo... https://nvd.nist.gov/vuln/detail/CVE-2022-31253 https://nvd.nist.gov/vuln/detail/CVE-2022-31253 Wed, 09 Nov 2022 14:15:11 +0000 High CVE-2022-31253

A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.

CVSS: 7.1 · CWE: CWE-426

View on NVD

]]> [High] CVE-2022-31256 – A Improper Link Resolution Before File Access ('Link Following') vulnerability i... https://nvd.nist.gov/vuln/detail/CVE-2022-31256 https://nvd.nist.gov/vuln/detail/CVE-2022-31256 Wed, 26 Oct 2022 09:15:15 +0000 High CVE-2022-31256

A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [Critical] CVE-2022-28321 – The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentica... https://nvd.nist.gov/vuln/detail/CVE-2022-28321 https://nvd.nist.gov/vuln/detail/CVE-2022-28321 Mon, 19 Sep 2022 22:15:10 +0000 Critical CVE-2022-28321

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumblewee…

CVSS: 9.8 · CWE: CWE-287

View on NVD

]]> [High] CVE-2022-31250 – A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tu... https://nvd.nist.gov/vuln/detail/CVE-2022-31250 https://nvd.nist.gov/vuln/detail/CVE-2022-31250 Wed, 20 Jul 2022 08:15:08 +0000 High CVE-2022-31250

A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.

CVSS: 7.1 · CWE: CWE-59

View on NVD

]]> [High] CVE-2021-36777 – A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login... https://nvd.nist.gov/vuln/detail/CVE-2021-36777 https://nvd.nist.gov/vuln/detail/CVE-2021-36777 Wed, 09 Mar 2022 17:15:09 +0000 High CVE-2021-36777

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.

CVSS: 8.1 · CWE: CWE-807

View on NVD

]]> [High] CVE-2022-21944 – A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service fi... https://nvd.nist.gov/vuln/detail/CVE-2022-21944 https://nvd.nist.gov/vuln/detail/CVE-2022-21944 Wed, 26 Jan 2022 09:15:06 +0000 High CVE-2022-21944

A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

CVSS: 7.8 · CWE: CWE-59

View on NVD

]]> [High] CVE-2021-25321 – A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux... https://nvd.nist.gov/vuln/detail/CVE-2021-25321 https://nvd.nist.gov/vuln/detail/CVE-2021-25321 Wed, 30 Jun 2021 09:15:08 +0000 High CVE-2021-25321

A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch ve…

CVSS: 7.8 · CWE: CWE-61

View on NVD

]]> [High] CVE-2021-25319 – A Incorrect Default Permissions vulnerability in the packaging of virtualbox of ... https://nvd.nist.gov/vuln/detail/CVE-2021-25319 https://nvd.nist.gov/vuln/detail/CVE-2021-25319 Wed, 05 May 2021 09:15:07 +0000 High CVE-2021-25319

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

CVSS: 7.8 · CWE: CWE-276

View on NVD

]]> [Critical] CVE-2021-25315 – CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Se... https://nvd.nist.gov/vuln/detail/CVE-2021-25315 https://nvd.nist.gov/vuln/detail/CVE-2021-25315 Wed, 03 Mar 2021 10:15:13 +0000 Critical CVE-2021-25315

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE L…

CVSS: 9.8 · CWE: CWE-287

View on NVD

]]> [High] CVE-2020-8027 – A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Se... https://nvd.nist.gov/vuln/detail/CVE-2020-8027 https://nvd.nist.gov/vuln/detail/CVE-2020-8027 Thu, 11 Feb 2021 16:15:12 +0000 High CVE-2020-8027

A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Serv…

CVSS: 7.3 · CWE: CWE-377

View on NVD

]]> [High] CVE-2020-8023 – A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the... https://nvd.nist.gov/vuln/detail/CVE-2020-8023 https://nvd.nist.gov/vuln/detail/CVE-2020-8023 Tue, 01 Sep 2020 12:15:10 +0000 High CVE-2020-8023

A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux En…

CVSS: 7.7 · CWE: CWE-349

View on NVD

]]> [High] CVE-2020-8026 – A Incorrect Default Permissions vulnerability in the packaging of inn in openSUS... https://nvd.nist.gov/vuln/detail/CVE-2020-8026 https://nvd.nist.gov/vuln/detail/CVE-2020-8026 Fri, 07 Aug 2020 10:15:11 +0000 High CVE-2020-8026

A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn ver…

CVSS: 8.4 · CWE: CWE-276

View on NVD

]]> [High] CVE-2020-8019 – A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslo... https://nvd.nist.gov/vuln/detail/CVE-2020-8019 https://nvd.nist.gov/vuln/detail/CVE-2020-8019 Mon, 29 Jun 2020 12:15:10 +0000 High CVE-2020-8019

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15…

CVSS: 7.7 · CWE: CWE-61

View on NVD

]]> [High] CVE-2020-8014 – A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopan... https://nvd.nist.gov/vuln/detail/CVE-2020-8014 https://nvd.nist.gov/vuln/detail/CVE-2020-8014 Mon, 29 Jun 2020 12:15:10 +0000 High CVE-2020-8014

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopano-spamd versions prior to 10.0.5-lp151.4.1. openSUSE Tumbleweed kopano-spamd versions prior to 10.0.5-1.1.

CVSS: 7.7 · CWE: CWE-61

View on NVD

]]> [High] CVE-2019-3681 – A External Control of File Name or Path vulnerability in osc of SUSE Linux Enter... https://nvd.nist.gov/vuln/detail/CVE-2019-3681 https://nvd.nist.gov/vuln/detail/CVE-2019-3681 Mon, 29 Jun 2020 12:15:10 +0000 High CVE-2019-3681

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise…

CVSS: 7.5 · CWE: CWE-73

View on NVD

]]> [High] CVE-2020-8015 – A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim ... https://nvd.nist.gov/vuln/detail/CVE-2020-8015 https://nvd.nist.gov/vuln/detail/CVE-2020-8015 Thu, 02 Apr 2020 08:15:21 +0000 High CVE-2020-8015

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.

CVSS: 8.4 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-3696 – A Improper Limitation of a Pathname to a Restricted Directory vulnerability in t... https://nvd.nist.gov/vuln/detail/CVE-2019-3696 https://nvd.nist.gov/vuln/detail/CVE-2019-3696 Tue, 03 Mar 2020 11:15:11 +0000 High CVE-2019-3696

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development To…

CVSS: 8.4 · CWE: CWE-22

View on NVD

]]> [High] CVE-2019-3695 – A Improper Control of Generation of Code vulnerability in the packaging of pcp o... https://nvd.nist.gov/vuln/detail/CVE-2019-3695 https://nvd.nist.gov/vuln/detail/CVE-2019-3695 Tue, 03 Mar 2020 11:15:11 +0000 High CVE-2019-3695

A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux En…

CVSS: 8.4 · CWE: CWE-94

View on NVD

]]> [High] CVE-2019-18903 – A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUS... https://nvd.nist.gov/vuln/detail/CVE-2019-18903 https://nvd.nist.gov/vuln/detail/CVE-2019-18903 Mon, 02 Mar 2020 17:15:18 +0000 High CVE-2019-18903

A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked ve…

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2019-18902 – A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUS... https://nvd.nist.gov/vuln/detail/CVE-2019-18902 https://nvd.nist.gov/vuln/detail/CVE-2019-18902 Mon, 02 Mar 2020 17:15:18 +0000 High CVE-2019-18902

A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked vers…

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2019-18897 – A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt ... https://nvd.nist.gov/vuln/detail/CVE-2019-18897 https://nvd.nist.gov/vuln/detail/CVE-2019-18897 Mon, 02 Mar 2020 16:15:11 +0000 High CVE-2019-18897

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 20…

CVSS: 8.4 · CWE: CWE-59

View on NVD

]]> [High] CVE-2020-7217 – An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and e... https://nvd.nist.gov/vuln/detail/CVE-2020-7217 https://nvd.nist.gov/vuln/detail/CVE-2020-7217 Tue, 11 Feb 2020 12:15:21 +0000 High CVE-2020-7217

An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.

CVSS: 7.5 · CWE: CWE-401

View on NVD

]]> [High] CVE-2020-7216 – An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier all... https://nvd.nist.gov/vuln/detail/CVE-2020-7216 https://nvd.nist.gov/vuln/detail/CVE-2020-7216 Wed, 05 Feb 2020 15:15:09 +0000 High CVE-2020-7216

An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option.

CVSS: 7.5 · CWE: CWE-401

View on NVD

]]> [High] CVE-2019-3699 – UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy... https://nvd.nist.gov/vuln/detail/CVE-2019-3699 https://nvd.nist.gov/vuln/detail/CVE-2019-3699 Fri, 24 Jan 2020 13:15:11 +0000 High CVE-2019-3699

UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-3697 – UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d... https://nvd.nist.gov/vuln/detail/CVE-2019-3697 https://nvd.nist.gov/vuln/detail/CVE-2019-3697 Fri, 24 Jan 2020 12:15:11 +0000 High CVE-2019-3697

UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-3694 – A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in o... https://nvd.nist.gov/vuln/detail/CVE-2019-3694 https://nvd.nist.gov/vuln/detail/CVE-2019-3694 Fri, 24 Jan 2020 11:15:11 +0000 High CVE-2019-3694

A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin version 2.0.40-lp151.1.1 and prior versions.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-3693 – A symlink following vulnerability in the packaging of mailman in SUSE Linux Ente... https://nvd.nist.gov/vuln/detail/CVE-2019-3693 https://nvd.nist.gov/vuln/detail/CVE-2019-3693 Fri, 24 Jan 2020 10:15:12 +0000 High CVE-2019-3693

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux…

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-3692 – The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap ... https://nvd.nist.gov/vuln/detail/CVE-2019-3692 https://nvd.nist.gov/vuln/detail/CVE-2019-3692 Fri, 24 Jan 2020 09:15:13 +0000 High CVE-2019-3692

The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version 2.6.2-2.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.2.47 and prior versions.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-3691 – A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in S... https://nvd.nist.gov/vuln/detail/CVE-2019-3691 https://nvd.nist.gov/vuln/detail/CVE-2019-3691 Thu, 23 Jan 2020 16:15:11 +0000 High CVE-2019-3691

A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE Factory munge versions prior to 0.5.13-6.1.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2019-18898 – UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of ... https://nvd.nist.gov/vuln/detail/CVE-2019-18898 https://nvd.nist.gov/vuln/detail/CVE-2019-18898 Thu, 23 Jan 2020 14:15:12 +0000 High CVE-2019-18898

UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.

CVSS: 7.7 · CWE: CWE-59

View on NVD

]]> [High] CVE-2018-17953 – A incorrect variable in a SUSE specific patch for pam_access rule matching in PA... https://nvd.nist.gov/vuln/detail/CVE-2018-17953 https://nvd.nist.gov/vuln/detail/CVE-2018-17953 Tue, 27 Nov 2018 13:29:00 +0000 High CVE-2018-17953

A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).

CVSS: 7.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2017-3224 – Open Shortest Path First (OSPF) protocol implementations may improperly determin... https://nvd.nist.gov/vuln/detail/CVE-2017-3224 https://nvd.nist.gov/vuln/detail/CVE-2017-3224 Tue, 24 Jul 2018 15:29:00 +0000 High CVE-2017-3224

Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger chec…

CVSS: 8.2 · CWE: CWE-354

View on NVD

]]> [High] CVE-2014-5220 – The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1... https://nvd.nist.gov/vuln/detail/CVE-2014-5220 https://nvd.nist.gov/vuln/detail/CVE-2014-5220 Fri, 08 Jun 2018 17:29:00 +0000 High CVE-2014-5220

The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.

CVSS: 7.8 · CWE: CWE-77

View on NVD

]]> [High] CVE-2018-7689 – Lack of permission checks in the InitializeDevelPackage function in openSUSE Ope... https://nvd.nist.gov/vuln/detail/CVE-2018-7689 https://nvd.nist.gov/vuln/detail/CVE-2018-7689 Thu, 07 Jun 2018 13:29:00 +0000 High CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

CVSS: 7.1 · CWE: CWE-862

View on NVD

]]> [High] CVE-2018-7688 – A missing permission check in the review handling of openSUSE Open Build Service... https://nvd.nist.gov/vuln/detail/CVE-2018-7688 https://nvd.nist.gov/vuln/detail/CVE-2018-7688 Thu, 07 Jun 2018 13:29:00 +0000 High CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

CVSS: 7.1 · CWE: CWE-862

View on NVD

]]> [High] CVE-2017-9286 – The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner,... https://nvd.nist.gov/vuln/detail/CVE-2017-9286 https://nvd.nist.gov/vuln/detail/CVE-2017-9286 Thu, 01 Mar 2018 20:29:01 +0000 High CVE-2017-9286

The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner, which could have allowed scripts running as wwwrun user to escalate privileges to root during nextcloud package upgrade.

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [Critical] CVE-2011-0469 – Code injection in openSUSE when running some source services used in the open bu... https://nvd.nist.gov/vuln/detail/CVE-2011-0469 https://nvd.nist.gov/vuln/detail/CVE-2011-0469 Thu, 17 Aug 2017 16:29:00 +0000 Critical CVE-2011-0469

Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.

CVSS: 9.8 · CWE: CWE-94

View on NVD

]]> [Critical] CVE-2016-4007 – Multiple unspecified vulnerabilities in the obs-service-extract_file package bef... https://nvd.nist.gov/vuln/detail/CVE-2016-4007 https://nvd.nist.gov/vuln/detail/CVE-2016-4007 Wed, 13 Apr 2016 14:59:11 +0000 Critical CVE-2016-4007

Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."

CVSS: 9.8 · CWE: N/A

View on NVD

]]> [High] CVE-2013-4159 – ctdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files secure... https://nvd.nist.gov/vuln/detail/CVE-2013-4159 https://nvd.nist.gov/vuln/detail/CVE-2013-4159 Wed, 06 Aug 2014 18:55:05 +0000 High CVE-2013-4159

ctdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files securely, which has unspecified impact related to "several temp file vulnerabilities" in (1) tcp/tcp_connect.c, (2) server/eventscript.c, (3) tools/ctdb_diagnostics, (4) config/gdb_backtrace, and (5) include/ctdb_private.h.

CVSS: 7.5 · CWE: CWE-264

View on NVD

]]> [High] CVE-2010-3110 – Multiple buffer overflows in the Novell Client novfs module for the Linux kernel... https://nvd.nist.gov/vuln/detail/CVE-2010-3110 https://nvd.nist.gov/vuln/detail/CVE-2010-3110 Tue, 12 Oct 2010 20:00:03 +0000 High CVE-2010-3110

Multiple buffer overflows in the Novell Client novfs module for the Linux kernel in SUSE Linux Enterprise 11 SP1 and openSUSE 11.3 allow local users to gain privileges via unspecified vectors.

CVSS: 7.2 · CWE: CWE-119

View on NVD

]]> [High] CVE-2010-2532 – lxsession-logout in lxsession in LXDE, as used on SUSE openSUSE 11.3 and other p... https://nvd.nist.gov/vuln/detail/CVE-2010-2532 https://nvd.nist.gov/vuln/detail/CVE-2010-2532 Fri, 03 Sep 2010 20:00:03 +0000 High CVE-2010-2532

lxsession-logout in lxsession in LXDE, as used on SUSE openSUSE 11.3 and other platforms, does not lock the screen when the Suspend or Hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action. NOTE: there is no general agreement that this is a vulnerability, because separate control over locking can be an equally…

CVSS: 7.2 · CWE: CWE-264

View on NVD

]]> [High] CVE-2010-0230 – SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to... https://nvd.nist.gov/vuln/detail/CVE-2010-0230 https://nvd.nist.gov/vuln/detail/CVE-2010-0230 Fri, 22 Jan 2010 21:30:00 +0000 High CVE-2010-0230

SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to listen on all network interfaces, which might allow remote attackers to bypass intended access restrictions.

CVSS: 7.5 · CWE: CWE-264

View on NVD

]]> [High] CVE-2009-0115 – The Device Mapper multipathing driver (aka multipath-tools or device-mapper-mult... https://nvd.nist.gov/vuln/detail/CVE-2009-0115 https://nvd.nist.gov/vuln/detail/CVE-2009-0115 Mon, 30 Mar 2009 16:30:00 +0000 High CVE-2009-0115

The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.

CVSS: 7.8 · CWE: CWE-732

View on NVD

]]> [High] CVE-2009-0310 – Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has ... https://nvd.nist.gov/vuln/detail/CVE-2009-0310 https://nvd.nist.gov/vuln/detail/CVE-2009-0310 Wed, 18 Feb 2009 16:30:00 +0000 High CVE-2009-0310

Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has unknown impact and attack vectors related to "incoming data and authentication-strings."

CVSS: 7.2 · CWE: CWE-119

View on NVD

]]> [High] CVE-2008-3188 – libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration sp... https://nvd.nist.gov/vuln/detail/CVE-2008-3188 https://nvd.nist.gov/vuln/detail/CVE-2008-3188 Tue, 22 Jul 2008 16:41:00 +0000 High CVE-2008-3188

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords.

CVSS: 7.5 · CWE: CWE-327

View on NVD

]]> [Critical] CVE-2008-2388 – Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified... https://nvd.nist.gov/vuln/detail/CVE-2008-2388 https://nvd.nist.gov/vuln/detail/CVE-2008-2388 Fri, 06 Jun 2008 22:32:00 +0000 Critical CVE-2008-2388

Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified impact and attack vectors. NOTE: the vendor states that these "can be considered no security problem."

CVSS: 10.0 · CWE: CWE-189

View on NVD

]]> [High] CVE-2008-0731 – The Linux kernel before 2.6.18.8-0.8 in SUSE openSUSE 10.2 does not properly han... https://nvd.nist.gov/vuln/detail/CVE-2008-0731 https://nvd.nist.gov/vuln/detail/CVE-2008-0731 Tue, 12 Feb 2008 21:00:00 +0000 High CVE-2008-0731

The Linux kernel before 2.6.18.8-0.8 in SUSE openSUSE 10.2 does not properly handle failure of an AppArmor change_hat system call, which might allow attackers to trigger the unconfining of an apparmored task.

CVSS: 7.5 · CWE: CWE-264

View on NVD

]]>