openSUSE Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with openSUSE products.

Products

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

CWE-121Jul 16, 2026
CVSS7.5v3.1EPSS0.47%PoCs0SignalsSTIX

obs-service-tar_scm: command injection via mercurial handler

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

CWE-78Jul 2, 2026
CVSS10.0v3.1EPSS0.375%PoCs0SignalsSTIX

openSUSE sdbootutil Insecure Temporary File Vulnerability

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in /var/lib/pcrlock.d * manipulate the data backed up in /tmp/pcrlock.d.bak, therefore violating the integrity of the data should it be restored. *  overwrite protected system files with data from /var/lib/pcrlock.d by placing symlinks to existing files in the directory tree in /tmp/pcrlock.d.bak…

CWE-377Feb 25, 2026
CVSS7.0v4.0EPSS0.108%PoCs0SignalsSTIX

SUSE-specific logrotate configuration allows escalation from mail user/group to root

A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.

CWE-61Oct 2, 2025
CVSS6.9v4.0EPSS0.157%PoCs0SignalsSTIX

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29.

CWE-61Sep 2, 2025
CVSS8.5v4.0EPSS0.161%PoCs0SignalsSTIX

XSS vulnerability found in OpenSuse MirrorCache

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the  REGEX and P parameters. This issue affects MirrorCache before 1.083.

CWE-79Nov 13, 2024
CVSS5.3v4.0EPSS0.322%PoCs0SignalsSTIX

Fixed temporary file path in aeon-checks allows fixing of disk encryption key

Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem

CWE-377Nov 13, 2024
CVSS7.3v4.0EPSS0.098%PoCs0SignalsSTIX

A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.

CWE-922Sep 19, 2023
CVSS7.8v3.1EPSS0.301%PoCs0SignalsSTIX

Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE Tumbleweed.

CWE-276Jul 7, 2023
CVSS7.8v3.1EPSS0.209%PoCs0SignalsSTIX

Stack buffer overflow in "read_file" function

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.

CWE-120Jun 1, 2023
CVSS3.3v3.1EPSS0.642%PoCs0SignalsSTIX

Stack buffer overflow in "econf_writeFile" function

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.

CWE-120Jun 1, 2023
CVSS3.3v3.1EPSS0.568%PoCs0SignalsSTIX

saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphan…

CWE-276Feb 15, 2023
CVSS7.0v3.1EPSS0.223%PoCs0SignalsSTIX

rmt-server-pubcloud allows to escalate from user _rmt to root

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4…

CWE-276Feb 7, 2023
CVSS7.8v3.1EPSS0.248%PoCs0SignalsSTIX

libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin…

CWE-78Feb 7, 2023
CVSS6.3v3.1EPSS2.45%PoCs0SignalsSTIX

paste: XSS on the image upload function

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493b and prior versions.

CWE-79Feb 7, 2023
CVSS4.3v3.1EPSS0.514%PoCs0SignalsSTIX

travel-support-program vulnerable to data exfiltration via Ransack query injection

Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The `*…

CWE-200CWE-89Jan 10, 2023
CVSS7.5v3.1EPSS1.02%PoCs0SignalsSTIX

openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself

A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.

CWE-426Nov 9, 2022
CVSS7.1v3.1EPSS0.33%PoCs0SignalsSTIX

permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()

A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to …

CWE-863Oct 6, 2022
CVSS4.4v3.1EPSS0.143%PoCs0SignalsSTIX

canna: unsafe handling of /tmp/.iroha_unix directory

A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there.

CWE-284Sep 7, 2022
CVSS5.3v3.1EPSS0.143%PoCs0SignalsSTIX

keylime %post scriplet allows for privilege escalation from keylime user to root

A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.

CWE-59Jul 20, 2022
CVSS7.1v3.1EPSS0.322%PoCs0SignalsSTIX

suddoers configuration for cscreen not restrictive enough

A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.

CWE-269CWE-732Mar 16, 2022
CVSS5.3v3.1EPSS0.26%PoCs0SignalsSTIX

cscreen: usage of fixed path /tmp/cscreen.debug

A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.

CWE-377Mar 16, 2022
CVSS5.1v3.1EPSS0.238%PoCs0SignalsSTIX

login-proxy sends password to attacker-provided domain

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.

CWE-807Mar 9, 2022
CVSS8.1v3.1EPSS0.91%PoCs0SignalsSTIX

watchman: chown in watchman@.socket unit allows symlink attack

A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

CWE-59CWE-61Jan 26, 2022
CVSS7.8v3.1EPSS0.287%PoCs0SignalsSTIX

parsec: dangerous 777 permissions for /run/parsec

A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.

CWE-276Jan 14, 2022
CVSS5.9v3.1EPSS0.207%PoCs0SignalsSTIX