Advisories · Technology
openSUSE Factory.
Every CVE that names openSUSE Factory among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.8 Medium
DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge
- openSUSE Factory
- Path traversal
- CVSS 5.5 Medium
obs-service-go_modules: arbitrary directory delete
- openSUSE Factory
- CWE-755
- CVSS 7.1 High
openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself
- openSUSE Factory
- CWE-426
- CVSS 7.7 High
sendmail: mail to root privilege escalation via sm-client.pre script
- openSUSE Factory
- Path traversal
- CVSS 6.5 Medium
slurm: %post for slurm-testsuite operates as root in user owned directory
- openSUSE Factory
- Broken access control
- CVSS 5.3 Medium
suddoers configuration for cscreen not restrictive enough
- openSUSE Factory
- Broken access control
- CVSS 5.1 Medium
cscreen: usage of fixed path /tmp/cscreen.debug
- openSUSE Factory
- CWE-377
- CVSS 5.1 Medium
grub2-once uses fixed file name in /var/tmp
- SUSE Linux Enterprise Server 15 SP4
- openSUSE Factory
- CWE-377
- CVSS 7.8 High
watchman: chown in [email protected] unit allows symlink attack
- openSUSE Backports SLE-15-SP3
- openSUSE Factory
- Path traversal
- CVSS 5.9 Medium
parsec: dangerous 777 permissions for /run/parsec
- openSUSE Factory
- Broken access control
- CVSS 3.2 Low
clone-master-clean-up: dangerous file system operations
- SUSE Linux Enterprise Server 12 SP3
- SUSE Linux Enterprise Server 15 SP1
- CVSS 7.8 High
arpwatch: Local privilege escalation from runtime user to root
- SUSE Linux Enterprise Server 11-SP4-LTSS
- SUSE Manager Server 4.0
- CWE-61
- CVSS 6.8 Medium
python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root
- openSUSE Leap 15.2
- openSUSE Factory
- CWE-61
- CVSS 6.8 Medium
python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root
- openSUSE Leap 15.2
- openSUSE Factory
- Path traversal
- CVSS 3.3 Low
cups: ownership of /var/log/cups allows the lp user to create files as root
- SUSE Linux Enterprise Server 11-SP4-LTSS
- SUSE Manager Server 4.0
- Broken access control
- CVSS 7.8 High
virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group
- openSUSE Factory
- Broken access control
- CVSS 6.7 Medium
Local privilege escalation to root due to insecure tmp file usage
- openSUSE Factory
- CWE-377
- CVSS 7.5 High
osc: stores downloaded (supposed) RPM in network-controlled filesystem paths
- SUSE Linux Enterprise Module for Development Tools 15
- SUSE Linux Enterprise Software Development Kit 12-SP5
- Path traversal
- CVSS 5.3 Medium
Problematic permissions in hylafax+ packaging allow escalation from uucp to other users
- openSUSE Leap 15.2
- openSUSE Leap 15.1
- Broken access control
- CVSS 8.4 High
Local privilege escalation in exim package from user mail to root
- openSUSE Factory
- Path traversal
- CVSS 7.5 High
wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
- SUSE Linux Enterprise Server 12
- SUSE Linux Enterprise Server 15
- Memory corruption
- CVSS 7.5 High
wicked: Use-after-free when receiving invalid DHCP6 client options
- SUSE Linux Enterprise Server 12
- SUSE Linux Enterprise Server 15
- Memory corruption
- CVSS 8.4 High
Local privilege escalation from user salt to root
- SUSE Linux Enterprise Server 12
- SUSE Linux Enterprise Server 15
- Path traversal
- CVSS 5.7 Medium
nagios cron job allows privilege escalation from user nagios to root
- SUSE Linux Enterprise Server 12
- SUSE Linux Enterprise Server 11
- Path traversal
- CVSS 4.3 Medium
obs-service-extract_file's outfilename parameter allows to write files outside of package directory
- SUSE Linux Enterprise Server 15
- openSUSE Factory
- Path traversal
- CVSS 2.9 Low
yast: Fallback to DES without configuration in /etc/login.def
- openSUSE Factory
- Weak cryptography or TLS
- CVSS 7.7 High
Local privilege escalation from user privoxy to root
- openSUSE Leap 15.1
- openSUSE Factory
- Path traversal
- CVSS 7.7 High
Local privilege escalation from munin to root in the packaging of munin
- openSUSE Factory
- openSUSE Leap 15.1
- Path traversal
- CVSS 7.7 High
Local privilege escalation from user news to root in the packaging of inn
- SUSE Linux Enterprise Server 11
- openSUSE Factory
- Path traversal
- CVSS 7.7 High
Local privilege escalation from user munge to root
- SUSE Linux Enterprise Server 15
- openSUSE Factory
- Path traversal
- CVSS 7.7 High
trousers: Local privilege escalation from tss to root
- SUSE Linux Enterprise Server 15 SP1
- openSUSE Factory
- Path traversal