A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

This update for texlive-filesystem fixes the following issues :

Security issues fixed :

  - CVE-2020-8016: Fixed a race condition in the spec file     (bsc#1159740).

  - CVE-2020-8017: Fixed a race condition on a cron job     (bsc#1158910).

This update was imported from the SUSE:SLE-15:Update update project.

This update for texlive fixes the following issues :

Security issues fixed :

CVE-2020-8016: Fixed a race condition in the spec file (bsc#1159740).

CVE-2020-8017: Fixed a race condition on a cron job (bsc#1158910).

Fixed an issue where pstopdf was crashing (bsc#1138793).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for texlive-filesystem fixes the following issues :

Security issues fixed :

CVE-2020-8016: Fixed a race condition in the spec file (bsc#1159740).

CVE-2020-8017: Fixed a race condition on a cron job (bsc#1158910).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
138682	openSUSE Security Update : texlive-filesystem (openSUSE-2020-804)	Nessus	SuSE Local Security Checks	high
137605	SUSE SLES12 Security Update : texlive (SUSE-SU-2020:1581-1)	Nessus	SuSE Local Security Checks	high
137604	SUSE SLED15 / SLES15 Security Update : texlive-filesystem (SUSE-SU-2020:1580-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-8017

medium

Tenable Plugins

high

high

high