CVE-2019-3681
A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - meissner@suse.de
- Published
- 2020-06-29
- Last modified
- 2024-09-17
- Weaknesses
- CWE-73
Affected products
- Opensuse Factory (Opensuse)
- Opensuse Leap 15.1 (Opensuse)
- Osc (Opensuse)
- Suse Linux Enterprise Module For Development Tools 15 (Suse)
- Suse Linux Enterprise Software Development Kit 12-sp4 (Suse)
- Suse Linux Enterprise Software Development Kit 12-sp5 (Suse)
References
- https://bugzilla.suse.com/show_bug.cgi?id=1122675
