{"id":"CVE-2016-5746","aliases":["EUVD-2016-6681","GHSA-v7w5-2xfr-963c","SUSE-SU-2016:2189-1","SUSE-SU-2016:2353-1","SUSE-SU-2016:2355-1"],"status":"published","title":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage...","description":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.","severity":{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00499,"percentile":0.43054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2016-08-30T07:48:38Z","modified":"2026-06-17T00:49:58Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libstorage","fixed_in":["2.25.35.1-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libstorage","fixed_in":["2.25.35.1-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libstorage","fixed_in":["2.25.35.1-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libstorage","fixed_in":["2.25.35.1-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"yast2-storage","fixed_in":["2.17.161-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"yast2-storage","fixed_in":["2.17.161-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"yast2-storage","fixed_in":["2.17.161-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libstorage","fixed_in":["2.25.16.1-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libstorage","fixed_in":["2.25.16.1-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libstorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.35.1-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libstorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.35.1-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libstorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.35.1-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libstorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.35.1-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"yast2-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.161-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"yast2-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.161-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"yast2-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.161-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libstorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.16.1-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libstorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.16.1-3.1"}]}]}],"products":[{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"libstorage"},{"vendor":"opensuse","product":"libstorage-ng"},{"vendor":"yast","product":"yast-storage"}],"references":[{"url":"https://github.com/openSUSE/libstorage/pull/162","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/yast/yast-storage/pull/224","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/yast/yast-storage/pull/226","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=986971","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/yast/yast-storage/pull/227","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/openSUSE/libstorage-ng/pull/123","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.securityfocus.com/bid/93169","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://github.com/yast/yast-storage/pull/223","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/openSUSE/libstorage/pull/163","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5746"},{"url":"https://github.com/advisories/GHSA-v7w5-2xfr-963c"},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162189-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/986971","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5746","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162353-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937942","tags":["report"]},{"url":"https://bugzilla.suse.com/984245","tags":["report"]},{"url":"https://bugzilla.suse.com/996208","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162355-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-5746","description":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.","status":"published","published":"2016-09-26T15:00:00Z","modified":"2024-08-06T01:07:59.951Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-6681","description":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.","status":"published","published":"2016-09-26T15:00:00Z","modified":"2024-08-06T01:07:59Z","updated_at":"2026-11-03T02:22:42.006781Z"}],"ghsa":[{"id":"GHSA-v7w5-2xfr-963c","title":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage...","description":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.","status":"published","published":"2022-05-14T02:12:20Z","modified":"2023-02-02T05:05:39Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:52:09.236869Z"}],"nvd":[{"id":"CVE-2016-5746","description":"libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.","status":"published","published":"2016-09-26T15:59:00.14Z","modified":"2026-06-17T00:49:58.62Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":1.2,"vector":"AV:L/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"SUSE-SU-2016:2189-1","title":"Security update for libstorage","description":"\nThis update for libstorage fixes the following issues:\n\n- Use stdin, not tmp files for passwords (bsc#986971, CVE-2016-5746)\n\n","status":"published","published":"2016-08-30T07:48:38Z","modified":"2026-02-04T03:26:13.345891Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2353-1","title":"Security update for yast2-storage","description":"\nThis update for yast2-storage provides the following fixes:\n\nSecurity issues fixed:\n- Use standard IPC, and not temporary files, to pass passwords between processes.\n  (bsc#986971, CVE-2016-5746)\n\nNon security bugs fixed:\n- Fix usage of complete multipath disk as LVM physical volume. (bsc#984245)\n- Load the correct multipath module (dm-multipath). (bsc#937942)\n- Improve message for creating volumes with a filesystem but without a mount point.\n  (bsc#996208)\n","status":"published","published":"2016-09-23T09:49:07Z","modified":"2026-02-04T02:30:53.962326Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2355-1","title":"Security update for libstorage","description":"\nThis update for libstorage fixes the following issues:\n\n- Use stdin, not tmp files for passwords (bsc#986971, CVE-2016-5746)\n","status":"published","published":"2016-09-23T10:16:05Z","modified":"2026-02-04T02:35:55.109984Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}