Summary
This update for permissions fixes the following issues:
Security issues fixed:
- CVE-2020-8013: Fixed a missing symlink check. Do not follow symlinks that are the final path element (bsc#1163922).
- Fixed a regression where chkstat broke when /proc was not available (bsc#1160764, bsc#1160594).
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| SUSE · Linux Enterprise Point of Sale 11 SP3 | permissions | 2013.1.7-0.6.12.1 |
| SUSE · SLES 11 SP4 Linux Enterprise Server 11 SP4-LTSS | permissions | 2013.1.7-0.6.12.1 |
Vulnerabilities 1
-
Low 2.2
permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim
A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously foll…