Lucene search

SuseCVE-2020-8016

HistoryApr 02, 2020 - 2:15 p.m.

CVE-2020-8016

2020-04-0214:15:15

CWE-367

suse

web.nvd.nist.gov

123

cve-2020-8016

race condition

link following

texlive-filesystem

suse linux enterprise

desktop applications

software development kit

opensuse leap

local users

file corruption

privilege escalation

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Affected configurations

Nvd

Node

suselinux_enterprise_desktopMatch15sp1

AND

opensusetexlive-filesystemRange<2017.135-9.5.1

Node

suselinux_enterprise_software_development_kitMatch12sp4

AND

opensusetexlive-filesystemRange<2013.74-16.5.1

Node

suselinux_enterprise_software_development_kitMatch12sp5

AND

opensusetexlive-filesystemRange<2013.74-16.5.1

Node

suselinux_enterprise_desktopMatch15-

AND

opensusetexlive-filesystemMatch-

Node

opensuseleapMatch15.1

AND

opensusetexlive-filesystemRange<2017.135-lp151.8.3.1

VendorProductVersionCPE
suselinux_enterprise_desktop15cpe:2.3:o:suse:linux_enterprise_desktop:15:sp1:*:*:*:*:*:*
opensusetexlive-filesystem*cpe:2.3:a:opensuse:texlive-filesystem:*:*:*:*:*:*:*:*
suselinux_enterprise_software_development_kit12cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*
suselinux_enterprise_software_development_kit12cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*
suselinux_enterprise_desktop15cpe:2.3:o:suse:linux_enterprise_desktop:15:-:*:*:*:*:*:*
opensusetexlive-filesystem-cpe:2.3:a:opensuse:texlive-filesystem:-:*:*:*:*:*:*:*
opensuseleap15.1cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
suse	linux_enterprise_desktop	15	cpe:2.3:o:suse:linux_enterprise_desktop:15:sp1::::::
opensuse	texlive-filesystem	*	cpe:2.3:a:opensuse:texlive-filesystem::::::::
suse	linux_enterprise_software_development_kit	12	cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4::::::
suse	linux_enterprise_software_development_kit	12	cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5::::::
suse	linux_enterprise_desktop	15	cpe:2.3:o:suse:linux_enterprise_desktop:15:-::::::
opensuse	texlive-filesystem	-	cpe:2.3:a:opensuse:texlive-filesystem:-:::::::*
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Module for Desktop Applications 15-SP1",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2017.135-9.5.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Software Development Kit 12-SP4",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2013.74-16.5.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Software Development Kit 12-SP5",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2013.74-16.5.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "openSUSE Leap 15.1",
    "versions": [
      {
        "version": "texlive-filesystem",
        "status": "affected",
        "lessThan": "2017.135-lp151.8.3.1",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html

bugzilla.suse.com/show_bug.cgi?id=1159740

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2020-8016