VDB
CVE-2016-5746
CVE-2016-5746
PUBLISHED
CVSS 5.099999904632568 MEDIUM
libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which might allow local users to obtain sensitive information by reading the file, as demonstrated by /tmp/libstorage-XXXXXX/pwdf.
EPSS 0.50% · 41.8th percentile
Risk Scores
CVSS 3.0
5.099999904632568
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.50%
41.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| opensuse | libstorage-ng | |
| n/a | n/a | n/a |
| opensuse | libstorage | |
| yast | yast-storage | |
| opensuse | leap | 42.1 |
Timeline
- Aug 30, 2016 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 2, 2023 EPSS Score
References
- https://bugzilla.suse.com/show_bug.cgi?id=986971 url
- https://github.com/yast/yast-storage/pull/227 url
- https://github.com/openSUSE/libstorage/pull/162 url
- openSUSE-SU-2016:2264 vendor-advisory
- 93169 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2016-5746 advisory
- https://github.com/openSUSE/libstorage/pull/163 url
- https://github.com/yast/yast-storage/pull/223 technical
- https://github.com/yast/yast-storage/pull/224 technical
- https://github.com/yast/yast-storage/pull/226 technical
- https://github.com/openSUSE/libstorage-ng/pull/123 technical