Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: SUSE supportutils — openSUSE-SU-2019:1351 Clear all filters
TI-2018-13921 CVE-2018-19640 · GHSA-7g5j-9rpf-g2r7

Code execution if run with command line switch -v

Priority LOW 25

If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00301 Published 2019-03-05 Fixed in 3.1-5.7.1 CWE-377
TI-2018-13920 CVE-2018-19639 · GHSA-82r4-3q2m-qgrm

Code execution if run with command line switch -v

Priority LOW 35

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00503 Published 2019-03-05 Fixed in 3.1-5.7.1 CWE-78
TI-2018-13919 CVE-2018-19638 · GHSA-8w66-9hvh-6jfx

User can overwrite arbitrary log files in support tar

Priority LOW 22

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

CVSS 3.0MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00399 Published 2019-03-05 Fixed in 3.1-5.7.1 CWE-377
TI-2018-13918 CVE-2018-19637 · GHSA-9w5f-7xrh-r828

Static temporary filename allows overwriting of files

Priority LOW 25

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00457 Published 2019-03-05 Fixed in 3.1-5.7.1 CWE-377