Suse Linux Enterprise Server Suse Linux Enterprise Server

stack.watch can notify you when security vulnerabilities are reported in Suse Linux Enterprise Server. You can add multiple products that you use with Suse Linux Enterprise Server to create your own personal software stack watcher.

By the Year

In 2020 there have been 9 vulnerabilities in Suse Linux Enterprise Server with an average score of 8.2 out of ten. Last year Suse Linux Enterprise Server had 1 security vulnerability published. That is, 8 more vulnerabilities have already been reported in 2020 as compared to last year. However, the average CVE base score of the vulnerabilities in 2020 is greater by 1.08.

Year Vulnerabilities Average Score
2020 9 8.18
2019 1 7.10
2018 7 6.67

It may take a day or so for new Suse Linux Enterprise Server vulnerabilities to show up. Additionally vulnerabilities may be tagged under a different product or component name.

Latest Suse Linux Enterprise Server Security Vulnerabilities

Use after free in WebGL in Google Chrome prior to 80.0.3987.149

CVE-2020-6422 8.8 - High - March 23, 2020

Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Dangling pointer

Use after free in media in Google Chrome prior to 80.0.3987.149

CVE-2020-6424 8.8 - High - March 23, 2020

Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Dangling pointer

Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149

CVE-2020-6426 6.5 - Medium - March 23, 2020

Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Memory Corruption

Use after free in audio in Google Chrome prior to 80.0.3987.149

CVE-2020-6427 8.8 - High - March 23, 2020

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Dangling pointer

Use after free in audio in Google Chrome prior to 80.0.3987.149

CVE-2020-6428 8.8 - High - March 23, 2020

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Dangling pointer

Use after free in audio in Google Chrome prior to 80.0.3987.149

CVE-2020-6429 8.8 - High - March 23, 2020

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Dangling pointer

Use after free in audio in Google Chrome prior to 80.0.3987.149

CVE-2020-6449 8.8 - High - March 23, 2020

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Dangling pointer

A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap

CVE-2018-20105 5.5 - Medium - January 27, 2020

A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.

Information Exposure Through Log Files

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page

CVE-2020-5504 8.8 - High - January 09, 2020

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root

CVE-2019-3688 7.1 - High - October 07, 2019

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary

Incorrect Default Permissions

A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may

CVE-2018-19655 8.8 - High - November 29, 2018

A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file.

Memory Corruption

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided

CVE-2018-12116 7.5 - High - November 28, 2018

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker

CVE-2018-12122 7.5 - High - November 28, 2018

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

Uncontrolled Resource Consumption ('Resource Exhaustion')

In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp

CVE-2018-19208 6.5 - Medium - November 12, 2018

In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.

NULL Pointer Dereference

An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50

CVE-2018-19052 7.5 - High - November 07, 2018

An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

Directory traversal

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path

CVE-2018-6556 3.3 - Low - August 10, 2018

lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.

Channel and Path Errors

Systems with microprocessors utilizing speculative execution and branch prediction may

CVE-2017-5753 5.6 - Medium - January 04, 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

Information Leak

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might

CVE-2015-3405 7.5 - High - August 09, 2017

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

Insufficient Entropy

Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1

CVE-2015-5707 - October 19, 2015

Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request.

Integer Overflow or Wraparound

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which

CVE-2010-4008 - November 17, 2010

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

Memory Corruption