CVE-2018-19636 Local root exploit via inclusion of attacker controlled shell script
HighCVSS 7.8
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openSUSE supportutils | < 3.1-5.7.1 | 3.1-5.7.1 |
| SUSE supportutils | < 3.1-5.7.1 | 3.1-5.7.1 |
References
- openSUSE-SU-2019:1351 vendor-advisory
- bugzilla.suse.com