Description
A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE Linux | SMT | unspecified – < 3.0.37 | 3.0.37 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES 12 SP2 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-2, SUSE-SU-2018:2898-1 |
| SLES 12 SP1 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES 12 SP1 | yast2-smt | 3.0.14-10.6.2 | SUSE-SU-2018:2898-1 |
| SLES 12 | perl-File-Touch | 0.11-3.2.2 | SUSE-SU-2018:2898-1 |
| SLES 12 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Subscription Management Tool 11 SP3 | smt | 2.0.34-50.8.1 | SUSE-SU-2018:2899-1 |
| SLES for SAP 12 SP3 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES for SAP 12 SP2 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES for SAP 12 SP1 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES for SAP 12 SP1 | yast2-smt | 3.0.14-10.6.2 | SUSE-SU-2018:2898-1 |
| SUSE OpenStack Cloud 7 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SUSE Enterprise Storage 4 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
Advisories 3
- SUSE-SU-2018:2899-1 Security update for smt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2898-2 Security update for smt, yast2-smt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2898-1 Security update for smt, yast2-smt SUSE / openSUSE Security Updates · Feb 4, 2026