: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libzypp | Mar 6, 2020 | Jan 24, 2020 |
| Suse | — | Upgrade ruby-solvUpgrade perl-solvUpgrade zypper-aptitudeUpgrade libzyppUpgrade zypperUpgrade zypper-logUpgrade python3-solvUpgrade libzypp-develUpgrade libsolv-develUpgrade python-solvUpgrade zypper-needs-restartingUpgrade libzypp-devel-docUpgrade libsolv-toolsUpgrade libsolv-demo | Jan 15, 2020 | Jan 13, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub