GCVE - cpe:2.3:a:suse:supportutils:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:suse:supportutils:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Suse (`ec535637-432e-5a38-96dd-4ec1e0138f73`)
Product	Supportutils (`55ec62b1-7564-5b4e-9fb5-7f4e44428f2f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-19640`	vulnerable	2026-06-08 05:11:15.971337	Code execution if run with command line switch -v MEDIUM (4.4) If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine. Published: 2019-03-05T16:00:00.000Z Updated: 2024-09-17T01:45:58.729Z Open on db.gcve.eu Reference links https://bugzilla.suse.com/show_bug.cgi?id=1118463 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19639`	vulnerable	2026-06-08 05:11:15.970997	Code execution if run with command line switch -v MEDIUM (6.7) If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root. Published: 2019-03-05T16:00:00.000Z Updated: 2024-09-16T20:43:12.181Z Open on db.gcve.eu Reference links https://bugzilla.suse.com/show_bug.cgi?id=1118462 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19638`	vulnerable	2026-06-08 05:11:15.970655	User can overwrite arbitrary log files in support tar LOW (2.2) In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files. Published: 2019-03-05T16:00:00.000Z Updated: 2024-09-17T00:06:09.548Z Open on db.gcve.eu Reference links https://bugzilla.suse.com/show_bug.cgi?id=1118460 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19637`	vulnerable	2026-06-08 05:11:15.970141	Static temporary filename allows overwriting of files LOW (2.8) Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection Published: 2019-03-05T16:00:00.000Z Updated: 2024-09-16T20:32:50.690Z Open on db.gcve.eu Reference links https://bugzilla.suse.com/show_bug.cgi?id=1117776 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19636`	vulnerable	2026-06-08 05:11:15.968996	Local root exploit via inclusion of attacker controlled shell script HIGH (7.3) Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges Published: 2019-03-05T16:00:00.000Z Updated: 2024-09-17T04:03:59.444Z Open on db.gcve.eu Reference links https://bugzilla.suse.com/show_bug.cgi?id=1117751 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.