CVE-2017-14804
package builds could use directory traversal to write outside of target area
- State
- Published
- Severity
- 9.9 Critical
- Published
- Mar 1, 2018
- Updated
- Sep 16, 2024
- Reserved
- Sep 27, 2017
Description
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.9 Critical | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | microfocus |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
buildSUSE |
|
References
- SUSE-SU-2017:3253vendor-advisory
- SUSE-SU-2018:0065vendor-advisory
- openSUSE-SU-2017:3259vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.