Every CVE Search/ Get API key

CVE-2018-19637

Static temporary filename allows overwriting of files

2.8 LowFix available

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.46%Up 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 2.8

Static temporary filename allows overwriting of files

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

Record
CVE-2018-19637
CVSS 3.0
2.8 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-377
Updated
2026-11-02
EUVDEUVD-2018-11322 2.8

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

Record
EUVD-2018-11322
CVSS 3.0
2.8 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-9w5f-7xrh-r828 5.5

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local...

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

Record
GHSA-9w5f-7xrh-r828
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
NVD 2.8

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

Record
CVE-2018-19637
CVSS 3.0
2.8 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness
CWE-377, CWE-59
Updated
2026-11-02
OSVopenSUSE-SU-2019:0293-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security issues fixed:

  • CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
  • CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
  • CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
  • CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).

Other issues fixed:

  • Fixed invalid exit code commands (bsc#1125666).
  • Included additional SUSE separation (bsc#1125609).
  • Merged added listing of locked packes by zypper.
  • Exclude pam.txt per GDPR by default (bsc#1112461).
  • Clarified -x functionality in supportconfig(8) (bsc#1115245).
  • udev service and provide the whole journal content in supportconfig (bsc#1051797).
  • supportconfig collects tuned profile settings (bsc#1071545).
  • sfdisk -d no disk device specified (bsc#1043311).
  • Added vulnerabilites status check in basic-health.txt (bsc#1105849).
  • Added only sched_domain from cpu0.
  • Blacklist sched_domain from proc.txt (bsc#1046681).
  • Added firewall-cmd info.
  • Add ls -lA --time-style=long-iso /etc/products.d/
  • Dump lsof errors.
  • Added corosync status to ha_info.
  • Dump find errors in ib_info.

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:0293-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11415-1 No score

supportutils-3.1.17-2.2 on GA media

These are all security issues fixed in the supportutils-3.1.17-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11415-1
Updated
2026-11-02
OSVSUSE-SU-2019:0480-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security issues fixed:

  • CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
  • CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
  • CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
  • CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).

Other issues fixed:

  • Fixed invalid exit code commands (bsc#1125666).
  • Included additional SUSE separation (bsc#1125609).
  • Merged added listing of locked packes by zypper.
  • Exclude pam.txt per GDPR by default (bsc#1112461).
  • Clarified -x functionality in supportconfig(8) (bsc#1115245).
  • udev service and provide the whole journal content in supportconfig (bsc#1051797).
  • supportconfig collects tuned profile settings (bsc#1071545).
  • sfdisk -d no disk device specified (bsc#1043311).
  • Added vulnerabilites status check in basic-health.txt (bsc#1105849).
  • Added only sched_domain from cpu0.
  • Blacklist sched_domain from proc.txt (bsc#1046681).
  • Added firewall-cmd info.
  • Add ls -lA --time-style=long-iso /etc/products.d/
  • Dump lsof errors.
  • Added corosync status to ha_info.
  • Dump find errors in ib_info.
Record
SUSE-SU-2019:0480-1
Updated
2026-11-02
OSVSUSE-SU-2019:1122-1 No score

Security update for hostinfo, supportutils

This update for hostinfo, supportutils fixes the following issues:

Security issues fixed for supportutils:

  • CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
  • CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
  • CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
  • CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).
  • CVE-2018-19636: Fixed a local root exploit via inclusion of attacker controlled shell script (bsc#1117751).

Other issues fixed for supportutils:

  • Fixed invalid exit code commands (bsc#1125666)
  • SUSE separation in supportconfig (bsc#1125623)
  • Clarified supportconfig(8) -x option (bsc#1115245)
  • supportconfig: 3.0.127
  • btrfs filesystem usage
  • List products.d
  • Dump lsof errors
  • Added ha commands for corosync
  • Dumped find errors in ib_info

Issues fixed in hostinfo:

  • Removed extra kernel install dates (bsc#1099498)
  • Resolved network bond issue (bsc#1054979)
Record
SUSE-SU-2019:1122-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
supportutils
SUSE:Linux Enterprise Module for Basesystem 15
 before 3.1-5.7.1
3.1-5.7.1
hostinfo
SUSE:OpenStack Cloud 7
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:OpenStack Cloud 7
 before 3.0-95.21.1
3.0-95.21.1
supportutils
SUSE:Linux Enterprise Desktop 12 SP3
 before 3.0-95.21.1
3.0-95.21.1
supportutils
SUSE:Linux Enterprise Desktop 12 SP4
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12-LTSS
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12-LTSS
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 1.0.1-19.5.1
1.0.1-19.5.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
supportutils
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP3
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP3
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP4
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP4
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Enterprise Storage 4
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Enterprise Storage 4
 before 3.0-95.21.1
3.0-95.21.1
supportutils
openSUSE:Tumbleweed
 before 3.1.17-2.2
3.1.17-2.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19637 is a low vulnerability (CVSS 2.8) in Opensuse Supportutils, published February 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in supportutils 3.1-5.7.1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open