Security update for supportutils SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1514-1 Final 1 1 2016-06-07T13:17:49Z current 2016-06-07T13:17:49Z 2016-06-07T13:17:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for supportutils supportutils was updated to fix one security issue. This security issue was fixed: - CVE-2016-1602: Code injection and privilege escalation via unescaped filenames (bsc#980670). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-supportutils-12602 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161514-1/ Link for SUSE-SU-2016:1514-1 https://lists.suse.com/pipermail/sle-security-updates/2016-June/002102.html E-Mail link for SUSE-SU-2016:1514-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/980670 SUSE Bug 980670 https://www.suse.com/security/cve/CVE-2016-1602/ SUSE CVE CVE-2016-1602 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 supportutils-1.20-121.1 supportutils-1.20-121.1 as a component of SUSE Linux Enterprise Server 11 SP4 supportutils-1.20-121.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root). CVE-2016-1602 SUSE Linux Enterprise Server 11 SP4:supportutils-1.20-121.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:supportutils-1.20-121.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161514-1/ https://www.suse.com/security/cve/CVE-2016-1602.html CVE-2016-1602 https://bugzilla.suse.com/1063385 SUSE Bug 1063385 https://bugzilla.suse.com/980670 SUSE Bug 980670