10

CVE-2016-4007

Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensuse ≫ Leap Version 42.1
Opensuse ≫ Opensuse Version 13.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.47% 0.825
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00046.html
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00049.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00050.html
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00019.html
https://build.opensuse.org/request/show/361096
Patch