Every CVE Search/ Get API key

CVE-2018-19639

Code execution if run with command line switch -v

6.7 MediumFix available

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.50%Down 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.7

Code execution if run with command line switch -v

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.

Record
CVE-2018-19639
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2018-11324 6.7

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.

Record
EUVD-2018-11324
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-82r4-3q2m-qgrm 7.8

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the...

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.

Record
GHSA-82r4-3q2m-qgrm
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 6.7

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.

Record
CVE-2018-19639
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
OSVopenSUSE-SU-2019:0293-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security issues fixed:

  • CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
  • CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
  • CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
  • CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).

Other issues fixed:

  • Fixed invalid exit code commands (bsc#1125666).
  • Included additional SUSE separation (bsc#1125609).
  • Merged added listing of locked packes by zypper.
  • Exclude pam.txt per GDPR by default (bsc#1112461).
  • Clarified -x functionality in supportconfig(8) (bsc#1115245).
  • udev service and provide the whole journal content in supportconfig (bsc#1051797).
  • supportconfig collects tuned profile settings (bsc#1071545).
  • sfdisk -d no disk device specified (bsc#1043311).
  • Added vulnerabilites status check in basic-health.txt (bsc#1105849).
  • Added only sched_domain from cpu0.
  • Blacklist sched_domain from proc.txt (bsc#1046681).
  • Added firewall-cmd info.
  • Add ls -lA --time-style=long-iso /etc/products.d/
  • Dump lsof errors.
  • Added corosync status to ha_info.
  • Dump find errors in ib_info.

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:0293-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11415-1 No score

supportutils-3.1.17-2.2 on GA media

These are all security issues fixed in the supportutils-3.1.17-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11415-1
Updated
2026-11-02
OSVSUSE-SU-2019:0480-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security issues fixed:

  • CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
  • CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
  • CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
  • CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).

Other issues fixed:

  • Fixed invalid exit code commands (bsc#1125666).
  • Included additional SUSE separation (bsc#1125609).
  • Merged added listing of locked packes by zypper.
  • Exclude pam.txt per GDPR by default (bsc#1112461).
  • Clarified -x functionality in supportconfig(8) (bsc#1115245).
  • udev service and provide the whole journal content in supportconfig (bsc#1051797).
  • supportconfig collects tuned profile settings (bsc#1071545).
  • sfdisk -d no disk device specified (bsc#1043311).
  • Added vulnerabilites status check in basic-health.txt (bsc#1105849).
  • Added only sched_domain from cpu0.
  • Blacklist sched_domain from proc.txt (bsc#1046681).
  • Added firewall-cmd info.
  • Add ls -lA --time-style=long-iso /etc/products.d/
  • Dump lsof errors.
  • Added corosync status to ha_info.
  • Dump find errors in ib_info.
Record
SUSE-SU-2019:0480-1
Updated
2026-11-02
OSVSUSE-SU-2019:1122-1 No score

Security update for hostinfo, supportutils

This update for hostinfo, supportutils fixes the following issues:

Security issues fixed for supportutils:

  • CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463).
  • CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).
  • CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).
  • CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).
  • CVE-2018-19636: Fixed a local root exploit via inclusion of attacker controlled shell script (bsc#1117751).

Other issues fixed for supportutils:

  • Fixed invalid exit code commands (bsc#1125666)
  • SUSE separation in supportconfig (bsc#1125623)
  • Clarified supportconfig(8) -x option (bsc#1115245)
  • supportconfig: 3.0.127
  • btrfs filesystem usage
  • List products.d
  • Dump lsof errors
  • Added ha commands for corosync
  • Dumped find errors in ib_info

Issues fixed in hostinfo:

  • Removed extra kernel install dates (bsc#1099498)
  • Resolved network bond issue (bsc#1054979)
Record
SUSE-SU-2019:1122-1
Updated
2026-11-02
OSVSUSE-SU-2019:13976-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security vulnerabilities fixed:

  • CVE-2018-19636: Local root exploit via inclusion of attacker controlled shell script (bsc#1117751)
  • CVE-2018-19640: Users can kill arbitrary processes (bsc#1118463)
  • CVE-2018-19638: User can overwrite arbitrary log files in support tar (bsc#1118460)
  • CVE-2018-19639: Code execution if run with -v (bsc#1118462)
Record
SUSE-SU-2019:13976-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
supportutils
SUSE:Linux Enterprise Module for Basesystem 15
 before 3.1-5.7.1
3.1-5.7.1
hostinfo
SUSE:OpenStack Cloud 7
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:OpenStack Cloud 7
 before 3.0-95.21.1
3.0-95.21.1
supportutils
SUSE:Linux Enterprise Desktop 12 SP3
 before 3.0-95.21.1
3.0-95.21.1
supportutils
SUSE:Linux Enterprise Desktop 12 SP4
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12-LTSS
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12-LTSS
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 1.0.1-19.5.1
1.0.1-19.5.1
Show 19 moreShow less
Affected packages
PackageAffectedFixed
supportutils
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP3
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP3
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server 12 SP4
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server 12 SP4
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.0-95.21.1
3.0-95.21.1
hostinfo
SUSE:Enterprise Storage 4
 before 1.0.1-19.5.1
1.0.1-19.5.1
supportutils
SUSE:Enterprise Storage 4
 before 3.0-95.21.1
3.0-95.21.1
supportutils
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.20-122.9.1
1.20-122.9.1
supportutils
SUSE:Linux Enterprise Server 11 SP4
 before 1.20-122.9.1
1.20-122.9.1
supportutils
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 1.20-122.9.1
1.20-122.9.1
supportutils
openSUSE:Tumbleweed
 before 3.1.17-2.2
3.1.17-2.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19639 is a medium vulnerability (CVSS 6.7) in Opensuse Supportutils, published February 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in supportutils 3.1-5.7.1.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open