race condition on texlive-filesystem cron job allows for the deletion of unintended files

CVE-2020-8017

6.2MEDIUM

Key Information

Vendor: Suse
Status: Suse Linux Enterprise Module For Desktop Applications 15-sp1; Suse Linux Enterprise Software Development Kit 12-sp4; Suse Linux Enterprise Software Development Kit 12-sp5; Opensuse Leap 15.1
Vendor: CVE Published:; 2 April 2020

Summary

A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Affected Version(s)

SUSE Linux Enterprise Module for Desktop Applications 15-SP1 < 2017.135-9.5.1

SUSE Linux Enterprise Software Development Kit 12-SP4 < 2013.74-16.5.1

SUSE Linux Enterprise Software Development Kit 12-SP5 < 2013.74-16.5.1

CVSS V3.1

Score:

6.2

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 6.3 to: 6.2 - (MEDIUM)
Feb 22, 2024
Vulnerability published.
Apr 2, 2020
Vulnerability Reserved.
Jan 27, 2020

Collectors

NVD DatabaseMitre Database

Credit

Matthias Gerstner of SUSE