rpm package
opensuse/permissions&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/permissions&distro=openSUSE%20Tumbleweed
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-31252 | — | < 1599_20220912-1.1 | 1599_20220912-1.1 | Oct 6, 2022 | A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location | ||
| CVE-2020-8013 | — | < 1550_20210901.1550-29.2 | 1550_20210901.1550-29.2 | Mar 2, 2020 | A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The sy | ||
| CVE-2019-3687 | — | < 1550_20210901.1550-29.2 | 1550_20210901.1550-29.2 | Jan 24, 2020 | The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 t | ||
| CVE-2019-3690 | — | < 1550_20210901.1550-29.2 | 1550_20210901.1550-29.2 | Dec 5, 2019 | The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privil | ||
| CVE-2019-3688 | — | < 1550_20210901.1550-29.2 | 1550_20210901.1550-29.2 | Oct 7, 2019 | The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the sq |
- CVE-2022-31252Oct 6, 2022affected < 1599_20220912-1.1fixed 1599_20220912-1.1
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location
- CVE-2020-8013Mar 2, 2020affected < 1550_20210901.1550-29.2fixed 1550_20210901.1550-29.2
A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The sy
- CVE-2019-3687Jan 24, 2020affected < 1550_20210901.1550-29.2fixed 1550_20210901.1550-29.2
The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 t
- CVE-2019-3690Dec 5, 2019affected < 1550_20210901.1550-29.2fixed 1550_20210901.1550-29.2
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privil
- CVE-2019-3688Oct 7, 2019affected < 1550_20210901.1550-29.2fixed 1550_20210901.1550-29.2
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the sq