race condition in the packaging of texlive-filesysten

CVE-2020-8016
4.9MEDIUM

Key Information

Vendor
Suse
Status
Suse Linux Enterprise Module For Desktop Applications 15-sp1
Suse Linux Enterprise Software Development Kit 12-sp4
Suse Linux Enterprise Software Development Kit 12-sp5
Opensuse Leap 15.1
Vendor
CVE Published:
2 April 2020

Summary

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Affected Version(s)

SUSE Linux Enterprise Module for Desktop Applications 15-SP1 < 2017.135-9.5.1

SUSE Linux Enterprise Software Development Kit 12-SP4 < 2013.74-16.5.1

SUSE Linux Enterprise Software Development Kit 12-SP5 < 2013.74-16.5.1

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Risk change from: 7 to: 4.9 - (MEDIUM)

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Matthias Gerstner of SUSE
.