CVE-2019-3687 "easy" permission profile allows everyone execute dumpcap and read all network traffic

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to...

CVE-2019-3687

CVE-2019-3687 affects the permissions package in SUSE/openSUSE SLE/OpenSUSE, allowing local users to run dumpcap with the easy permission profile and sniff network traffic. Affected range: permissions versions from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119...

CVE-2019-3693: Improper Link Resolution Before File Access

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This...

CVE-2019-3687: Incorrect Default Permissions

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to...

PT-2020-10910

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa Description The issue in the permission package of SUSE Linux Enterprise Server allowed all...

CVE-2019-18900: Incorrect Default Permissions

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp version...

CVE-2019-3692: Improper Link Resolution Before File Access

The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version...

CVE-2019-3691 Local privilege escalation from user munge to root

A Symbolic Link Symlink Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE...

CVE-2019-3691

CVE-2019-3691 is a local privilege escalation in the munge packaging for SUSE Linux Enterprise Server 15 and openSUSE Factory, caused by a Symbolic Link (Symlink) Following issue. Affected Munge versions are prior to 0.5.13-4.3.1 on SLES 15 and prior to 0.5.13-6.1 on openSUSE Factory. The vulnera...

CVE-2019-18898

UNIX Symbolic Link Symlink Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1...

Spoofing

UNIX Symbolic Link Symlink Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1...

CVE-2019-18898 trousers: Local privilege escalation from tss to root

UNIX Symbolic Link Symlink Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1...

CVE-2019-18898

CVE-2019-18898 concerns a local symlink attack in the trousers package for SUSE/openSUSE, allowing a local attacker (tss user) to gain ownership of arbitrary files during installation/update. The issue affects SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1 and openSUS...

CVE-2019-3691: Improper Link Resolution Before File Access

A Symbolic Link Symlink Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE...

CVE-2019-18898: Improper Link Resolution Before File Access

UNIX Symbolic Link Symlink Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1...

SUSE SLES12 Security Update : libssh (SUSE-SU-2020:0131-1)

This update for libssh fixes the following issues : CVE-2019-14889: Fixed an unwanted command execution in scp caused by unsanitized location bsc1158095. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempte...

PT-2020-1514

Name of the Vulnerable Software and Affected Versions SUSE CaaS Platform versions prior to 16.21.2-27.68.1 SUSE Linux Enterprise Server 12 versions prior to 16.21.2-2.45.1 SUSE Linux Enterprise Server 15 version 17.19.0-3.34.1 Description The issue is related to incorrect default permissions in t...

CVE-2019-18898

UNIX Symbolic Link Symlink Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1...

PT-2020-10911

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1 openSUSE Factory munge versions prior to 0.5.13-6.1 Description A Symbolic Link Symlink Following issue in the packaging of munge allowed local attackers to escalate privileg...

CVE-2019-3688

CVE-2019-3688 affects the /usr/sbin/pinger binary shipped with squid on SUSE/OpenSUSE, where the binary had squid:root, 0750 permissions. The local attacker who has compromised the squid user could replace or modify the binary to achieve persistence. Affected products include SUSE Linux Enterpris...