openSUSE osc vulnerabilities

Latest openSUSE osc CVEs

Newest publication first

1. CVE-2019-3681 osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

   Published 2020-06-29

   Critical·CVSS 9.8 EPSS 1.4%

   A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote...

2. CVE-2012-1095 osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a t...

   Published 2014-02-06

   Medium·CVSS 4.3 EPSS 1.4%

   osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.