VDB

CVE-2019-3681

CVE-2019-3681 PUBLISHED CVSS 7.5 HIGH

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

EPSS 1.42% · 71.0th percentile

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
1.42%
71.0th percentile

Affected Products

VendorProductVersions
Ubuntu:25.10osc1.15.1-1, 0, 1.12.1-2
Ubuntu:16.04:LTSosc0, 0.152.0-1
Ubuntu:24.04:LTSosc0, 0.169.1-2ubuntu1, 0.169.1-2
Ubuntu:20.04:LTSosc0.164.2-1build1, 0.164.2-1, 0
Ubuntu:18.04:LTSosc0.161.1-1, 0.160.0-1, 0.162.1-1
Ubuntu:22.04:LTSosc0.169.1-1, 0

Timeline

  • Jun 3, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Mar 1, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 2, 2022 EPSS Score
  • May 24, 2022 CVE Updated
  • Sep 6, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›