37 matches found
OPENSUSE-SU-2026:12308-1 sdbootutil-1+git20261026.4e266f0-1.1 on GA media
These are all security issues fixed in the sdbootutil-1+git20261026.4e266f0-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-104618
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104618
The sdbootutil script creates a debug log at /var/log/sdbootutil.log with world-readable permissions. This misconfiguration allows arbitrary low-privileged users on the system to access and extract sensitive secrets from the log file. No specific remediation or exploit details are provided in the...
EUVD-2026-101945
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104618 sdbootutil: world-readable debug log
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104618 sdbootutil: world-readable debug log
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104617
The sdbootutil utility contains a vulnerability where two invocations of qrencode to display QR codes leak sensitive private data, specifically the $pin and $key . This information is exposed via /proc//cmdline , making it accessible to arbitrary low-privileged users on the system. The vulnerabil...
CVE-2026-104617 sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
There are two invocations of qrencode to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system...
CVE-2026-104617 sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
There are two invocations of qrencode to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system...
PT-2026-114842
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104618: Incorrect Permission Assignment for Critical Resource
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
SUSE Linux Enterprise Server Trust Management Vulnerability
SUSE Linux Enterprise Server 16.1, SUSE Linux Enterprise Server for NVIDIA 16.1, and openSUSE Leap 16.1 have a trust management issue. This issue arises from two calls to qrencode when displaying QR codes via sdbootutil, which allows private data $pin/$key to be leaked through /proc. Any user wit...
SUSE Linux Enterprise Server Permission Licensing and Access Control Vulnerabilities
SUSE Linux Enterprise Server 16.1, SUSE Linux Enterprise Server for NVIDIA 16.1, and openSUSE Leap 16.1 have vulnerabilities related to permission permissions and access control. These vulnerabilities stem from the debug logs created by the sdbootutil script, which are globally readable. This cou...
SUSE CVE-2026-104618
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
openSUSE 16: sdbootutil / sdbootutil-bash-completion / etc (openSUSE-SU-2026:21933-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21933-1 advisory. Security issues fixed: - CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270192. -...
Security update for sdbootutil (important)
openSUSE security update: security update for sdbootutil ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21933-1 Rating: important References: bsc1234010 bsc1270192 bsc1270420 bsc1270471 bsc1270616 bsc1270670 bsc1270742 bsc1270863 bsc1270922...
OPENSUSE-SU-2026:21933-1 Security update for sdbootutil
This update for sdbootutil fixes the following issues: Security issues fixed: - CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270192. - CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in...
sdbootutil-1+git20260713.d869cf8-1.1 on GA media (moderate)
sdbootutil-1+git20260713.d869cf8-1.1 on GA media Announcement ID: openSUSE-SU-2026:11262-1 Rating: moderate Cross-References: CVE-2026-41677 CVE-2026-41678 CVE-2026-41681 CVE-2026-41898 CVE-2026-42327 CVE-2026-44662 CVE-2026-45784 CVSS scores: CVE-2026-41677 SUSE : 3.7...
PT-2026-59007
These are all security issues fixed in the sdbootutil-1+git20260713.d869cf8-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:11262-1 sdbootutil-1+git20260713.d869cf8-1.1 on GA media
These are all security issues fixed in the sdbootutil-1+git20260713.d869cf8-1.1 package on the GA media of openSUSE Tumbleweed...