Upstream information
Description
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 4.3 |
Vector | AV:L/AC:L/Au:S/C:P/I:P/A:P |
Access Vector | Local |
Access Complexity | Low |
Authentication | Single |
Confidentiality Impact | Partial |
Integrity Impact | Partial |
Availability Impact | Partial |
- openSUSE-SU-2019:2177-1, published Tue, 24 Sep 2019 15:20:38 +0200 (CEST)
- openSUSE-SU-2019:2188-1, published Wed, 25 Sep 2019 18:10:50 +0200 (CEST)
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Package Hub 12 |
| Patchnames: openSUSE-2016-790 |
openSUSE Leap 15.0 |
| Patchnames: openSUSE-2019-2177 |
openSUSE Leap 15.1 |
| Patchnames: openSUSE-2019-2188 |
openSUSE Tumbleweed |
| Patchnames: openSUSE Tumbleweed GA fish-2.4.0-1.1 |