CVE-2018-12476: obs-service-extract_file's outfilename parameter allows to write files outside of package directory
SUSE · SUSE Linux Enterprise Server 15
Vendor fix available · Affected: SUSE Linux Enterprise Server 15 · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 64% of scored CVEs
DescriptionCVE.org
Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- SUSE · SUSE Linux Enterprise Server 15from obs-service-tar_scm before 0.9.2.1537788075.fefaa74:
- openSUSE · Factoryfrom obs-service-tar_scm before 0.9.2.1537788075.fefaa74
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- SUSE
- Published
- January 2020
CoverageNo articles yet
No CyberSIXT article names CVE-2018-12476 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.