Vulnerability Description
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Texlive-Filesystem | < 2017.135-9.5.1 |
| Suse | Linux Enterprise Desktop | 15 |
| Suse | Linux Enterprise Software Development Kit | 12 |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.htmlBroken LinkMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1158910Issue TrackingVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.htmlBroken LinkMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1158910Issue TrackingVendor Advisory
FAQ
What is CVE-2020-8017?
CVE-2020-8017 is a vulnerability with a CVSS score of 6.2 (MEDIUM). A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software D...
How severe is CVE-2020-8017?
CVE-2020-8017 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-8017?
Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Texlive-Filesystem, Suse Linux Enterprise Desktop, Suse Linux Enterprise Software Development Kit, Opensuse Leap.