Local privilege escalation in exim package from user mail to root
CVE-2020-8015

8.4HIGH

Key Information:

Vendor

Opensuse
Status
Factory
Vendor
CVE Published:
2 April 2020

What is CVE-2020-8015?

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.

Affected Version(s)

Factory exim < 4.93.0.4-3.1

References

http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE
https://bugzilla.suse.com/show_bug.cgi?id=1154183
x_refsource_CONFIRM

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Johannes Segitz of SUSE
.