Read the docs
TI-2023-15484 Aliases CVE-2023-32182GHSA-wcv5-982f-xggc

Link following in SUSE Linux Enterprise Desktop 15 SP5

Priority LOW 34CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SUSE Linux Enterprise Desktop 15 SP5 (SUSE): 3.7.3-150500.3.5.1SUSE Linux Enterprise High Performance Computing 15 SP5 (SUSE): 3.7.3-150500.3.5.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Desktop 15 SP5? to before 3.7.3-150500.3.5.13.7.3-150500.3.5.1Patch availableCNA
SUSESUSE Linux Enterprise High Performance Computing 15 SP5? to before 3.7.3-150500.3.5.13.7.3-150500.3.5.1Patch availableCNA
SUSEopenSUSE Leap 15.5 ? to before 3.7.3-150500.3.5.13.7.3-150500.3.5.1Patch availableCNA
  • SUSE Linux Enterprise Desktop 15 SP5 VendorSUSE Affected ? to before 3.7.3-150500.3.5.1 Fixed in 3.7.3-150500.3.5.1 Patch available CNA
  • SUSE Linux Enterprise High Performance Computing 15 SP5 VendorSUSE Affected ? to before 3.7.3-150500.3.5.1 Fixed in 3.7.3-150500.3.5.1 Patch available CNA
  • openSUSE Leap 15.5 VendorSUSE Affected ? to before 3.7.3-150500.3.5.1 Fixed in 3.7.3-150500.3.5.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:*15.5VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:-:*:*:*15.0 sp5VulnerableSUSE
cpe:2.3:o:suse:suse_linux_enterprise_desktop:15:sp5:*:*:*:*:*:*15 sp5VulnerableSUSE
  • cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:* Versions 15.5 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:-:*:*:* Versions 15.0 sp5 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux_enterprise_desktop:15:sp5:*:*:*:*:*:* Versions 15 sp5 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE Linux Enterprise Desktop 15 SP5 (SUSE) Fixed in 3.7.3-150500.3.5.1
  • Fix · CNA SUSE Linux Enterprise High Performance Computing 15 SP5 (SUSE) Fixed in 3.7.3-150500.3.5.1
  • Fix · CNA openSUSE Leap 15.5 (SUSE) Fixed in 3.7.3-150500.3.5.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32182
  2. 2026-10-03 Alias added: GHSA-wcv5-982f-xggc

References

Exploit 1

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2021-02923 Out-of-bounds write in polkit KEVCVSS 3.1HIGH 7.8
  • TI-2020-06495 outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues CVSS 3.1CRITICAL 9.3
  • TI-2024-31348 An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. CVSS 3.1HIGH 7.8
  • TI-2024-31345 An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. CVSS 3.1HIGH 7.8
  • TI-2024-31343 An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. CVSS 3.1HIGH 7.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences