Advisories · Technology
openSUSE Tumbleweed.
Every CVE that names openSUSE Tumbleweed among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
sdbootutil: world-readable debug log
- SUSE Linux Enterprise Server 16.1
- SUSE Linux Enterprise Server for NVIDIA 16.1
- Broken access control
- CVSS 5.9 Medium
sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
- SUSE Linux Enterprise Server 16.1
- SUSE Linux Enterprise Server for NVIDIA 16.1
- Hard-coded credentials
- CVSS 7.1 High
LPE from suricata user to root due to chown in %post in suricata packaging
- openSUSE Tumbleweed
- CWE-61
- CVSS 5.1 Medium
csync2 uses insecure temporary directories when compiled with C99 or later
- openSUSE Tumbleweed
- Race condition
- CVSS 6.9 Medium
Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock
- openSUSE Tumbleweed
- CWE-754
- CVSS 6.9 Medium
SUSE-specific logrotate configuration allows escalation from mail user/group to root
- openSUSE Tumbleweed
- CWE-61
- CVSS 8.5 High
openSUSE Tumbleweed: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE…
- openSUSE Tumbleweed
- CWE-61
- CVSS 4.8 Medium
The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess
- openSUSE Tumbleweed
- CWE-807
- CVSS 9.8 CriticalCritical · CVSS 9+
daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root
- openSUSE Tumbleweed
- CWE-61
- CVSS 7.8 High
gerbera: Privilege escalation from user gerbera to root because of insecure %post script
- openSUSE Tumbleweed
- Broken access control
- CVSS 7.0 High
grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images
- openSUSE Tumbleweed
- Broken access control
- CVSS 5.3 Medium
XSS vulnerability found in OpenSuse MirrorCache
- openSUSE Tumbleweed
- Cross-site scripting (XSS)
- CVSS 7.3 High
Fixed temporary file path in aeon-checks allows fixing of disk encryption key
- openSUSE Tumbleweed
- CWE-377
- CVSS 5.5 Medium
Crafted projects can overwrite special files in the .osc config directory
- SUSE Linux Enterprise Desktop 15 SP5
- SUSE Linux Enterprise High Performance Computing 15 SP5
- CVSS 5.1 Medium
obs-service-download_url is vulnerable to argument injection
- SUSE Package Hub 15 SP5
- SUSE Package Hub 15 SP6
- Command injection
- CVSS 8.5 High
mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable
- openSUSE Tumbleweed
- Memory corruption
- CVSS 7.8 High
Incorrect default permissions in openSUSE Tumbleweed
- openSUSE Tumbleweed
- Broken access control
- CVSS 7.1 High
keylime %post scriplet allows for privilege escalation from keylime user to root
- openSUSE Tumbleweed
- Path traversal
- CVSS 6.1 Medium
outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues
- SUSE Linux Enterprise Server 12-SP4
- SUSE Linux Enterprise Server 15-LTSS
- CWE-279
- CVSS 8.4 High
inn: non-root owned files
- openSUSE Leap 15.2
- openSUSE Tumbleweed
- Broken access control
- CVSS 7.7 High
kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackage
- openSUSE Leap 15.1
- openSUSE Tumbleweed
- CWE-61