Description
A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen
This issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openSUSE | opensuse-welcome | 0.1 – < 0.1.9+git.35.4b9444a | 0.1.9+git.35.4b9444a |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | opensuse-welcome | 0.1.9+git.35.4b9444a-bp155.2.3.1 | openSUSE-SU-2023:0219-1 |
| SUSE Package Hub 15 SP4 | opensuse-welcome | 0.1.9+git.0.66be0d8-bp154.2.6.1 | openSUSE-SU-2023:0230-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | opensuse-welcome | 0.1.9+git.35.4b9444a-bp155.2.3.1 | openSUSE-SU-2023:0219-1 |
| openSUSE Leap 15.4 | opensuse-welcome | 0.1.9+git.0.66be0d8-bp154.2.6.1 | openSUSE-SU-2023:0230-1 |
Advisories 2
- openSUSE-SU-2023:0219-1 Security update for opensuse-welcome SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2023:0230-1 Security update for opensuse-welcome SUSE / openSUSE Security Updates · Feb 4, 2026