CVE-2016-4007 Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via....
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- openSUSE-SU-2016:0521 vendor-advisory
- openSUSE-SU-2016:1659 vendor-advisory
- openSUSE-SU-2016:1660 vendor-advisory
- SUSE-SU-2016:1839 vendor-advisory
- build.opensuse.org patch