7.3
High
CVE-2018-19636 Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath…
Description
Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| supportutils 3.1 | earliest → < 3.1-5.7.1 | 3.1-5.7.1 |
References
- bugzilla.suse.com bugzilla.suse.com
- openSUSE-SU-2019:1351 lists.opensuse.org
Timeline
- Published
- Last modified
Other CVEs of supportutils
The 5 CVEs of supportutils →
CVE-2018-19640
If the attacker manages to create files in the directory used to collect log files in supportutils before version…
4.4
Medium
CVE-2018-19637
Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite…
2.8
Low
CVE-2018-19638
In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have…
2.2
Low
CVE-2018-19639
If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to…
6.7
Medium