CVE-2020-8016

race condition in the packaging of texlive-filesysten

State: Published
Severity: 4.9 Medium
Published: Apr 2, 2020
Updated: Sep 16, 2024
Reserved: Jan 27, 2020

Description

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L	suse

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
SUSE Linux Enterprise Module for Desktop Applications 15-SP1SUSE	texlive-filesystem to before 2017.135-9.5.1Affected
SUSE Linux Enterprise Software Development Kit 12-SP4SUSE	texlive-filesystem to before 2013.74-16.5.1Affected
SUSE Linux Enterprise Software Development Kit 12-SP5SUSE	texlive-filesystem to before 2013.74-16.5.1Affected
openSUSE Leap 15.1openSUSE	texlive-filesystem to before 2017.135-lp151.8.3.1Affected

References

openSUSE-SU-2020:0804vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1159740

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.