race condition in the packaging of texlive-filesysten
CVE-2020-8016

4.9MEDIUM

Key Information:

Vendor
Suse
Status
Suse Linux Enterprise Module For Desktop Applications 15-sp1
Suse Linux Enterprise Software Development Kit 12-sp4
Suse Linux Enterprise Software Development Kit 12-sp5
Opensuse Leap 15.1
Vendor
CVE Published:
2 April 2020

Summary

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Affected Version(s)

openSUSE Leap 15.1 texlive-filesystem < 2017.135-lp151.8.3.1

SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem < 2017.135-9.5.1

SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem < 2013.74-16.5.1

References

http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1159740

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner of SUSE
.