All the vulnerabilites related to openSUSE - Leap 15.1
cve-2019-3692
Vulnerability from cvelistv5
Published
2020-01-24 08:50
Modified
2024-09-16 20:51
Severity ?
EPSS score ?
Summary
Local privilege escalation from user news to root in the packaging of inn
References
▼ | URL | Tags |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00027.html | vendor-advisory, x_refsource_SUSE | |
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
https://bugzilla.suse.com/show_bug.cgi?id=1154302 | x_refsource_CONFIRM |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:19:17.781Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "openSUSE-SU-2020:0234", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00027.html" }, { "name": "openSUSE-SU-2020:0242", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00028.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154302" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SUSE Linux Enterprise Server 11", "vendor": "SUSE", "versions": [ { "lessThanOrEqual": "2.4.2-170.21.3.1", "status": "affected", "version": "inn", "versionType": "custom" } ] }, { "product": "Factory", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "2.6.2-2.2", "status": "affected", "version": "inn", "versionType": "custom" } ] }, { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "2.5.4-lp151.2.47", "status": "affected", "version": "inn", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Johannes Segitz of SUSE" } ], "datePublic": "2020-01-24T00:00:00", "descriptions": [ { "lang": "en", "value": "The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version 2.6.2-2.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.2.47 and prior versions." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-11-20T15:45:08", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "name": "openSUSE-SU-2020:0234", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00027.html" }, { "name": "openSUSE-SU-2020:0242", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00028.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154302" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1154302", "defect": [ "1154302" ], "discovery": "INTERNAL" }, "title": "Local privilege escalation from user news to root in the packaging of inn", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-01-24T00:00:00.000Z", "ID": "CVE-2019-3692", "STATE": "PUBLIC", "TITLE": "Local privilege escalation from user news to root in the packaging of inn" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SUSE Linux Enterprise Server 11", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "inn", "version_value": "2.4.2-170.21.3.1" } ] } } ] }, "vendor_name": "SUSE" }, { "product": { "product_data": [ { "product_name": "Factory", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "inn", "version_value": "2.6.2-2.2" } ] } }, { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "inn", "version_value": "2.5.4-lp151.2.47" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Johannes Segitz of SUSE" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version 2.6.2-2.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.2.47 and prior versions." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "openSUSE-SU-2020:0234", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00027.html" }, { "name": "openSUSE-SU-2020:0242", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00028.html" }, { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1154302", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154302" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1154302", "defect": [ "1154302" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-3692", "datePublished": "2020-01-24T08:50:12.217219Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-16T20:51:57.334Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-18903
Vulnerability from cvelistv5
Published
2020-03-02 16:45
Modified
2024-09-17 01:00
Severity ?
EPSS score ?
Summary
wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
References
▼ | URL | Tags |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1160904 | x_refsource_CONFIRM |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T02:02:39.712Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160904" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SUSE Linux Enterprise Server 12", "vendor": "SUSE", "versions": [ { "lessThan": "0.6.60-2.18.1", "status": "affected", "version": "wicked", "versionType": "custom" } ] }, { "product": "SUSE Linux Enterprise Server 15", "vendor": "SUSE", "versions": [ { "lessThan": "0.6.60-28.26.1", "status": "affected", "version": "wicked", "versionType": "custom" } ] }, { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThan": "0.6.60-lp151.2.9.1", "status": "affected", "version": "wicked", "versionType": "custom" } ] }, { "product": "Factory", "vendor": "openSUSE", "versions": [ { "lessThan": "0.6.62", "status": "affected", "version": "wicked", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Malte Kraus" } ], "datePublic": "2020-02-06T00:00:00", "descriptions": [ { "lang": "en", "value": "A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416: Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-03-02T16:45:18", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160904" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1160904", "defect": [ "1160904" ], "discovery": "INTERNAL" }, "title": "wicked: Use-after-free when receiving invalid DHCP6 IA_PD option", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-02-06T00:00:00.000Z", "ID": "CVE-2019-18903", "STATE": "PUBLIC", "TITLE": "wicked: Use-after-free when receiving invalid DHCP6 IA_PD option" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SUSE Linux Enterprise Server 12", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.60-2.18.1" } ] } }, { "product_name": "SUSE Linux Enterprise Server 15", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.60-28.26.1" } ] } } ] }, "vendor_name": "SUSE" }, { "product": { "product_data": [ { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.60-lp151.2.9.1" } ] } }, { "product_name": "Factory", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.62" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Malte Kraus" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-416: Use After Free" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1160904", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160904" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1160904", "defect": [ "1160904" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-18903", "datePublished": "2020-03-02T16:45:18.618041Z", "dateReserved": "2019-11-12T00:00:00", "dateUpdated": "2024-09-17T01:00:28.473Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-3699
Vulnerability from cvelistv5
Published
2020-01-24 12:25
Modified
2024-09-16 21:02
Severity ?
EPSS score ?
Summary
Local privilege escalation from user privoxy to root
References
▼ | URL | Tags |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1157449 | x_refsource_CONFIRM |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:19:17.418Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1157449" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "3.0.28-lp151.1.1", "status": "affected", "version": "privoxy", "versionType": "custom" } ] }, { "product": "Factory", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "3.0.28-2.1", "status": "affected", "version": "privoxy", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Johannes Segitz of SUSE" } ], "datePublic": "2020-01-24T00:00:00", "descriptions": [ { "lang": "en", "value": "UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-11-20T15:45:08", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1157449" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1157449", "defect": [ "1157449" ], "discovery": "INTERNAL" }, "title": "Local privilege escalation from user privoxy to root", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-01-24T00:00:00.000Z", "ID": "CVE-2019-3699", "STATE": "PUBLIC", "TITLE": "Local privilege escalation from user privoxy to root" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "privoxy", "version_value": "3.0.28-lp151.1.1" } ] } }, { "product_name": "Factory", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "privoxy", "version_value": "3.0.28-2.1" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Johannes Segitz of SUSE" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1157449", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1157449" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1157449", "defect": [ "1157449" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-3699", "datePublished": "2020-01-24T12:25:12.967744Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-16T21:02:19.137Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-3694
Vulnerability from cvelistv5
Published
2020-01-24 10:50
Modified
2024-09-17 00:26
Severity ?
EPSS score ?
Summary
Local privilege escalation from munin to root in the packaging of munin
References
▼ | URL | Tags |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1155078 | x_refsource_CONFIRM |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:19:17.485Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1155078" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Factory", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "2.0.49-4.2", "status": "affected", "version": "munin", "versionType": "custom" } ] }, { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "2.0.40-lp151.1.1", "status": "affected", "version": "munin", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Johannes Segitz of SUSE" } ], "datePublic": "2020-01-24T00:00:00", "descriptions": [ { "lang": "en", "value": "A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin version 2.0.40-lp151.1.1 and prior versions." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-11-20T15:45:08", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1155078" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1155078", "defect": [ "1155078" ], "discovery": "INTERNAL" }, "title": "Local privilege escalation from munin to root in the packaging of munin", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-01-24T00:00:00.000Z", "ID": "CVE-2019-3694", "STATE": "PUBLIC", "TITLE": "Local privilege escalation from munin to root in the packaging of munin" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Factory", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "munin", "version_value": "2.0.49-4.2" } ] } }, { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "munin", "version_value": "2.0.40-lp151.1.1" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Johannes Segitz of SUSE" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin version 2.0.40-lp151.1.1 and prior versions." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1155078", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1155078" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1155078", "defect": [ "1155078" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-3694", "datePublished": "2020-01-24T10:50:11.606027Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-17T00:26:07.628Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-3693
Vulnerability from cvelistv5
Published
2020-01-24 10:05
Modified
2024-09-17 02:46
Severity ?
EPSS score ?
Summary
Local privilege escalation from user wwwrun to root in the packaging of mailman
References
▼ | URL | Tags |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html | vendor-advisory, x_refsource_SUSE | |
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html | vendor-advisory, x_refsource_SUSE | |
https://bugzilla.suse.com/show_bug.cgi?id=1154328 | x_refsource_CONFIRM |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:19:17.443Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "openSUSE-SU-2020:0148", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html" }, { "name": "openSUSE-SU-2020:0156", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154328" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SUSE Linux Enterprise Server 11", "vendor": "SUSE", "versions": [ { "lessThan": "2.1.15-9.6.15.1", "status": "affected", "version": "mailman", "versionType": "custom" } ] }, { "product": "SUSE Linux Enterprise Server 12", "vendor": "SUSE", "versions": [ { "lessThan": "2.1.17-3.11.1", "status": "affected", "version": "mailman", "versionType": "custom" } ] }, { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "2.1.29-lp151.2.14", "status": "affected", "version": "mailman", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Johannes Segitz of SUSE" } ], "datePublic": "2019-11-26T00:00:00", "descriptions": [ { "lang": "en", "value": "A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-11-20T15:45:08", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "name": "openSUSE-SU-2020:0148", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html" }, { "name": "openSUSE-SU-2020:0156", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154328" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1154328", "defect": [ "1154328" ], "discovery": "INTERNAL" }, "title": "Local privilege escalation from user wwwrun to root in the packaging of mailman", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2019-11-26T00:00:00.000Z", "ID": "CVE-2019-3693", "STATE": "PUBLIC", "TITLE": "Local privilege escalation from user wwwrun to root in the packaging of mailman" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SUSE Linux Enterprise Server 11", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "mailman", "version_value": "2.1.15-9.6.15.1" } ] } }, { "product_name": "SUSE Linux Enterprise Server 12", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "mailman", "version_value": "2.1.17-3.11.1" } ] } } ] }, "vendor_name": "SUSE" }, { "product": { "product_data": [ { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "mailman", "version_value": "2.1.29-lp151.2.14" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Johannes Segitz of SUSE" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "openSUSE-SU-2020:0148", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html" }, { "name": "openSUSE-SU-2020:0156", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html" }, { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1154328", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154328" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1154328", "defect": [ "1154328" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-3693", "datePublished": "2020-01-24T10:05:17.025101Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-17T02:46:37.656Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-3697
Vulnerability from cvelistv5
Published
2020-01-24 12:10
Modified
2024-09-17 01:31
Severity ?
EPSS score ?
Summary
Local privilege escalation from user gnump3d to root
References
▼ | URL | Tags |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1154229 | x_refsource_CONFIRM |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:19:17.970Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154229" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThanOrEqual": "3.0-lp151.2.1", "status": "affected", "version": "gnump3d", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Johannes Segitz of SUSE" } ], "datePublic": "2020-01-24T00:00:00", "descriptions": [ { "lang": "en", "value": "UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-11-20T15:45:08", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154229" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1154229", "defect": [ "1154229" ], "discovery": "INTERNAL" }, "title": "Local privilege escalation from user gnump3d to root", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-01-24T00:00:00.000Z", "ID": "CVE-2019-3697", "STATE": "PUBLIC", "TITLE": "Local privilege escalation from user gnump3d to root" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "gnump3d", "version_value": "3.0-lp151.2.1" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Johannes Segitz of SUSE" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1154229", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1154229" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1154229", "defect": [ "1154229" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-3697", "datePublished": "2020-01-24T12:10:11.878267Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-17T01:31:57.295Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-18902
Vulnerability from cvelistv5
Published
2020-03-02 16:45
Modified
2024-09-17 02:41
Severity ?
EPSS score ?
Summary
wicked: Use-after-free when receiving invalid DHCP6 client options
References
▼ | URL | Tags |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1160903 | x_refsource_CONFIRM |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T02:02:39.848Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160903" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SUSE Linux Enterprise Server 12", "vendor": "SUSE", "versions": [ { "lessThan": "0.6.60-3.5.1", "status": "affected", "version": "wicked", "versionType": "custom" } ] }, { "product": "SUSE Linux Enterprise Server 15", "vendor": "SUSE", "versions": [ { "lessThan": "0.6.60-3.21.1", "status": "affected", "version": "wicked", "versionType": "custom" } ] }, { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThan": "0.6.60-lp151.2.6.1", "status": "affected", "version": "wicked", "versionType": "custom" } ] }, { "product": "Factory", "vendor": "openSUSE", "versions": [ { "lessThan": "0.6.62", "status": "affected", "version": "wicked", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Malte Kraus" } ], "datePublic": "2020-01-30T00:00:00", "descriptions": [ { "lang": "en", "value": "A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416: Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-03-02T16:45:18", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160903" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1160903", "defect": [ "1160903" ], "discovery": "INTERNAL" }, "title": "wicked: Use-after-free when receiving invalid DHCP6 client options", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-01-30T00:00:00.000Z", "ID": "CVE-2019-18902", "STATE": "PUBLIC", "TITLE": "wicked: Use-after-free when receiving invalid DHCP6 client options" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SUSE Linux Enterprise Server 12", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.60-3.5.1" } ] } }, { "product_name": "SUSE Linux Enterprise Server 15", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.60-3.21.1" } ] } } ] }, "vendor_name": "SUSE" }, { "product": { "product_data": [ { "product_name": "Leap 15.1", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.60-lp151.2.6.1" } ] } }, { "product_name": "Factory", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "wicked", "version_value": "0.6.62" } ] } } ] }, "vendor_name": "openSUSE" } ] } }, "credit": [ { "lang": "eng", "value": "Malte Kraus" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-416: Use After Free" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.suse.com/show_bug.cgi?id=1160903", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160903" } ] }, "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1160903", "defect": [ "1160903" ], "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-18902", "datePublished": "2020-03-02T16:45:18.218099Z", "dateReserved": "2019-11-12T00:00:00", "dateUpdated": "2024-09-17T02:41:08.903Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-18899
Vulnerability from cvelistv5
Published
2020-01-23 15:00
Modified
2024-09-17 01:25
Severity ?
EPSS score ?
Summary
apt-cacher-ng insecure use of /run/apt-cacher-ng
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T02:02:39.815Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "openSUSE-SU-2020:0124", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html" }, { "name": "openSUSE-SU-2020:0146", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html" }, { "tags": [ "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1157703" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Leap 15.1", "vendor": "openSUSE", "versions": [ { "lessThan": "3.1-lp151.3.3.1", "status": "affected", "version": "apt-cacher-ng", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Matthias Gerstner of SUSE" } ], "datePublic": "2020-01-20T00:00:00", "descriptions": [ { "lang": "en", "value": "The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-10-13T00:00:00", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse" }, "references": [ { "name": "openSUSE-SU-2020:0124", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html" }, { "name": "openSUSE-SU-2020:0146", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html" }, { "url": "https://bugzilla.suse.com/show_bug.cgi?id=1157703" } ], "source": { "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1157703", "defect": [ "1157703" ], "discovery": "INTERNAL" }, "title": "apt-cacher-ng insecure use of /run/apt-cacher-ng", "x_generator": { "engine": "Vulnogram 0.0.9" } } }, "cveMetadata": { "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-18899", "datePublished": "2020-01-23T15:00:20.234353Z", "dateReserved": "2019-11-12T00:00:00", "dateUpdated": "2024-09-17T01:25:34.093Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }