MEDIUM🇵🇱 Wersja polska

CVE-2019-18900

CVSS 4.0v3.1pub. 2020-01-24upd. 2024-11-21

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Opensuse Libzypp

    APP
    Opensuse
    < 16.21.2-27.68.1< 16.21.2-2.45.1< 17.19.0-3.34.1

  • SUSE Caas Platform

    OS
    Suse
    3.0

  • SUSE Linux Enterprise Server

    OS
    Suse
    1215
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-25315CRITICAL9.8ten sam produkt

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumblew...

CVE-2017-18017CRITICAL9.8ten sam produkt

The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x befo...

CVE-2015-5041CRITICAL9.1ten sam produkt

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, an...

CVE-2015-8776CRITICAL9.1ten sam produkt

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers...

CVE-2014-9761CRITICAL9.8ten sam produkt

Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-depe...