Malte Kraus

A symbolic link issue was found in rpm, occurring when rpm sets the desired permissions and credentials after installing a file. This flaw could be exploited by a local unprivileged user to exchange the original file with a symbolic link to a security-critical file, potentially escalating their privileges on the system. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

A vulnerability in cryptctl allows attackers with access to the hashed password to use it without having to crack it. This issue enables attackers to bypass proper authentication mechanisms.

A vulnerability in the configuration of salt allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself, code can be executed as user salt, potentially allowing for escalation to root there.

A UNIX Symbolic Link (Symlink) Following issue in chkstat affects SUSE Linux Enterprise Server, causing it to set permissions intended for specific binaries on other binaries because it erroneously follows symlinks. However, exploitation is difficult since the symlinks cannot be controlled by attackers on default systems. This issue is related to the incorrect determination of a link before accessing a file, which may allow an attacker to elevate their privileges.

A Use After Free issue in wicked allows remote attackers to cause Denial of Service (DoS) or potentially execute code.

A memory leak in the `ni dhcp4 fsm process dhcp4 packet` function allows network attackers to cause a denial of service by sending DHCP4 packets with a different `client-id`.

A Use After Free issue in wicked allows remote attackers to cause Denial of Service (DoS) or potentially execute code.

A memory leak in the `ni dhcp4 parse response` function allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option. This issue can be exploited by sending specifically crafted packets, potentially leading to a denial of service.

The issue in the permission package of SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile, enabling them to sniff network traffic.

The issue is related to the chkstat tool in the permissions package, which followed symlinks, allowing local attackers with control over a traversed path to escalate privileges. This is due to errors in handling symbolic links.

The issue is related to insecure privilege management in the pam-python PAM module, which allows an attacker to escalate privileges using a specially crafted binary file with the setuid flag. This can lead to local root escalation in certain PAM setups. The vulnerability is due to the default environment variable handling of Python, which can be manipulated by a local user to gain access with root privileges.

The issue is related to the incorrect assignment of standard permissions in the `nsm drop privileges` function of the nfs-utils package. This can allow a remote attacker to access confidential data, compromise its integrity, and trick processes running with root privileges into creating or overwriting files anywhere on the system. The directory `/var/lib/nfs` is owned by `statd:nogroup` and contains files owned and managed by root, which can be exploited if `statd` is compromised.

The issue is related to errors in handling permissions in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. This can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information. The problem arises because the setfsuid function is not used, leading to mishandling of file ownership.

The issue is caused by a race condition in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. This occurs due to concurrent execution using a shared resource with incorrect synchronization, allowing a remote attacker to potentially impact the integrity, confidentiality, and availability of protected information.

The issue is related to the mishandling of a file's user and group ownership during move and copy operations from admin:// to file:// URIs in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in GNOME. This is due to the unavailability of root privileges. The vulnerability may allow a remote attacker to impact the integrity, confidentiality, and availability of protected information when copying files using G FILE COPY ALL METADATA.

The issue arises when the system does not have a swap already configured and does not use btrfs as its filesystem, resulting in the creation of world-readable swap files.

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4, openSUSE Leap 15.1, and openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue is related to incorrect external control of file name or path, which may allow a remote attacker to elevate their privileges.