Lucene search

[email protected]CVE-2020-8016

HistoryApr 02, 2020 - 2:15 p.m.

CVE-2020-8016

2020-04-0214:15:15

CWE-367

[email protected]

web.nvd.nist.gov

117

cve-2020-8016

race condition

link following

texlive-filesystem

suse linux enterprise

desktop applications

software development kit

opensuse leap

local users

file corruption

privilege escalation

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Affected configurations

NVD

Node

suselinux_enterprise_desktopMatch15sp1

AND

opensusetexlive-filesystemRange<2017.135-9.5.1

Node

suselinux_enterprise_software_development_kitMatch12sp4

AND

opensusetexlive-filesystemRange<2013.74-16.5.1

Node

suselinux_enterprise_software_development_kitMatch12sp5

AND

opensusetexlive-filesystemRange<2013.74-16.5.1

Node

suselinux_enterprise_desktopMatch15-

AND

opensusetexlive-filesystemMatch-

Node

opensuseleapMatch15.1

AND

opensusetexlive-filesystemRange<2017.135-lp151.8.3.1

CPENameOperatorVersion
opensuse:texlive-filesystemopensuse texlive-filesystemlt2017.135-9.5.1

CPE	Name	Operator	Version
opensuse:texlive-filesystem	opensuse texlive-filesystem	lt	2017.135-9.5.1

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Module for Desktop Applications 15-SP1",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2017.135-9.5.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Software Development Kit 12-SP4",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2013.74-16.5.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Software Development Kit 12-SP5",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2013.74-16.5.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "openSUSE Leap 15.1",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2017.135-lp151.8.3.1",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html

bugzilla.suse.com/show_bug.cgi?id=1159740

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2020-8016

nvd1 ubuntucve1 cvelist1 prion1 suse1 openvas4 nessus3