Opensuse Factory vulnerabilities

• opensuse factory, openldap2 +1 more openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself CVE-2022-31253 7.1 HighNovember 9, 2022
• opensuse factory, suse opensuse factory +1 more sendmail: mail to root privilege escalation via sm-client.pre script CVE-2022-31256 Fix available 7.7 HighOctober 26, 2022
• opensuse factory, suse opensuse factory +1 more slurm: %post for slurm-testsuite operates as root in user owned directory CVE-2022-31251 6.5 MediumSeptember 7, 2022
• opensuse cscreen, factory +1 more suddoers configuration for cscreen not restrictive enough CVE-2022-21946 5.3 MediumMarch 16, 2022
• opensuse cscreen, factory +1 more cscreen: usage of fixed path /tmp/cscreen.debug CVE-2022-21945 5.1 MediumMarch 16, 2022
• cobbler project cobbler, fedoraproject fedora, opensuse backports +2 more +4 more Command Injection in Cobbler CVE-2021-45082 Fix available 7.8 HighFebruary 18, 2022
• opensuse factory, factory watchman, backports sle-15-sp3 +2 more watchman: chown in [email protected] unit allows symlink attack CVE-2022-21944 Fix available 7.8 HighJanuary 17, 2022
• opensuse factory parsec: dangerous 777 permissions for /run/parsec CVE-2021-36781 Fix available 5.9 MediumJanuary 14, 2022
• uriparser project uriparser, debian linux, fedoraproject extra packages for enterprise linux +4 more +6 more An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in... CVE-2021-46141 Fix available 5.5 MediumJanuary 6, 2022
• uriparser project uriparser, debian linux, fedoraproject extra packages for enterprise linux +4 more +6 more An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in... CVE-2021-46142 Fix available 5.5 MediumJanuary 6, 2022
• vim, vim vim/vim, apple mac os x +6 more +8 more Out-of-bounds Read in vim/vim CVE-2021-4166 Fix available 7.1 HighDecember 25, 2021
• ruby-lang cgi, ruby, debian linux +6 more +8 more Cookie Prefix Spoofing in CGI::Cookie.parse CVE-2021-41819 Fix available 7.5 HighDecember 23, 2021
• ruby-lang date, ruby, debian linux +6 more +8 more Regular expression denial of service vulnerability (ReDoS) in date CVE-2021-41817 Fix available 7.5 HighNovember 16, 2021
• opensuse factory, suse linux enterprise server, opensuse factory +2 more +4 more clone-master-clean-up: dangerous file system operations CVE-2021-32000 Fix available 3.2 LowJuly 28, 2021
• opensuse factory, leap 15.2, suse arpwatch +3 more +5 more arpwatch: Local privilege escalation from runtime user to root CVE-2021-25321 Fix available 7.8 HighJune 28, 2021
• opensuse factory, leap 15.2, python-hyperkitty project python-hyperkitty +2 more python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root CVE-2021-25322 6.8 MediumJune 10, 2021
• opensuse factory, leap 15.2, python-postorius +2 more python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root CVE-2021-31997 6.8 MediumJune 10, 2021
• opensuse factory virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group CVE-2021-25319 7.8 HighMay 5, 2021
• opensuse factory, leap 15.2, suse cups +4 more +6 more cups: ownership of /var/log/cups allows the lp user to create files as root CVE-2021-25317 Fix available 3.3 LowApril 30, 2021
• opensuse cyrus-sasl, factory +1 more Local privilege escalation to root due to insecure tmp file usage CVE-2020-8032 Fix available 6.7 MediumFebruary 25, 2021
• opensuse factory, leap 15.1, leap 15.2 +2 more +4 more Problematic permissions in hylafax+ packaging allow escalation from uucp to other users CVE-2020-8024 Fix available 5.3 MediumJune 29, 2020
• opensuse factory, leap 15.1, osc +4 more +6 more osc: stores downloaded (supposed) RPM in network-controlled filesystem paths CVE-2019-3681 Fix available 7.5 HighJune 3, 2020
• exim, opensuse factory +1 more Local privilege escalation in exim package from user mail to root CVE-2020-8015 Fix available 8.4 HighApril 2, 2020
• opensuse factory, suse linux enterprise server, linux enterprise server 12 +2 more +4 more Local privilege escalation from user salt to root CVE-2019-18897 8.4 HighMarch 2, 2020
• nagios, opensuse factory, suse linux enterprise server 11 +3 more +5 more nagios cron job allows privilege escalation from user nagios to root CVE-2019-3698 5.7 MediumFebruary 28, 2020
• opensuse factory, leap, leap 15.1 +3 more +5 more wicked: Use-after-free when receiving invalid DHCP6 IA_PD option CVE-2019-18903 7.5 HighFebruary 6, 2020
• opensuse factory, leap, leap 15.1 +3 more +5 more wicked: Use-after-free when receiving invalid DHCP6 client options CVE-2019-18902 7.5 HighJanuary 30, 2020
• suse yast2-security, opensuse factory +1 more yast: Fallback to DES without configuration in /etc/login.def CVE-2019-3700 Fix available 2.9 LowJanuary 24, 2020
• opensuse factory, leap 15.1, privoxy +2 more Local privilege escalation from user privoxy to root CVE-2019-3699 7.7 HighJanuary 24, 2020
• opensuse factory, leap 15.1, munin +2 more Local privilege escalation from munin to root in the packaging of munin CVE-2019-3694 7.7 HighJanuary 24, 2020
• opensuse factory, leap, leap 15.1 +3 more +5 more Local privilege escalation from user news to root in the packaging of inn CVE-2019-3692 Fix available 7.7 HighJanuary 24, 2020
• opensuse factory, suse linux enterprise server 15 sp1, trousers +1 more +3 more trousers: Local privilege escalation from tss to root CVE-2019-18898 Fix available 7.7 HighDecember 19, 2019
• opensuse factory, munge, suse linux enterprise server 15 +2 more Local privilege escalation from user munge to root CVE-2019-3691 Fix available 7.7 HighDecember 5, 2019
• opensuse factory, suse linux enterprise server 15, obs-service-tar scm +2 more obs-service-extract_file's outfilename parameter allows to write files outside of package directory CVE-2018-12476 4.3 MediumMarch 4, 2019