PT-2013-1492 · Suse · Suse Zypper+1

Published 2012-07-18 · Updated 2013-12-03 · CVE-2012-0420

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SUSE Zypper versions prior to 1.3.20 SUSE Zypper versions 1.6.x prior to 1.6.166

Description The issue allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPP LOCKFILE ROOT environment variable.

Recommendations For SUSE Zypper versions prior to 1.3.20, update to version 1.3.20 or later. For SUSE Zypper versions 1.6.x prior to 1.6.166, update to version 1.6.166 or later.

Fix

Related Identifiers

CVE-2012-0420

SUSE-SU-2012_0889-1

Affected Products

Suse Zypper

Suse

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0420 · Security Note
• https://support.novell.com/security/cve/CVE-2012-0420.html · Vendor Advisory
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://bugzilla.novell.com/show_bug.cgi?id=770630 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2012-July/000186.html · Note
• http://download.novell.com/patch/finder/?keywords=21b0014e7ebe0f97d850cca8d0be6bd5 · Note
• https://bugzilla.novell.com/770630 · Note
• http://download.novell.com/patch/finder/?keywords=857c5c5bf8d9a57d64e50045ec7ef20d · Note
• http://support.novell.com/security/cve/CVE-2012-0420.html · Note