race condition in the packaging of texlive-filesysten

published 2020-04-02 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28929

cvss: 4.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits: 0; none known

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Patch / fix

fixed in 4 distros 2

SUSE SUSE Linux Enterprise Module for Desktop Applications 15-SP1 2017.135-9.5.1
SUSE SUSE Linux Enterprise Software Development Kit 12-SP4 2013.74-16.5.1
SUSE SUSE Linux Enterprise Software Development Kit 12-SP5 2013.74-16.5.1
openSUSE openSUSE Leap 15.1 2017.135-lp151.8.3.1

suse opensuse

texlive-filesystem SLE Module for Desktop Applications 15 SP2, SLE Module for Desktop Applications 15 SP1 2017.135-9.12.1
texlive SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 2013.20130620-22.8.2
texlive-filesystem SLE Software Development Kit 12 SP5, SLE Software Development Kit 12 SP4 2013.74-16.12.1
texlive SLE Module for Desktop Applications 15 SP1 2017.20170520-11.13.2

suse advisories SUSE-SU-2020:1580-2 SUSE-SU-2020:1581-1 SUSE-SU-2020:1580-1

texlive openSUSE Tumbleweed 2021.20210325.svn34398-76.3
texlive-filesystem openSUSE Tumbleweed 2021.185.svn54495-52.2
texlive-filesystem openSUSE Leap 15.1 2017.135-lp151.8.6.1
texlive openSUSE Leap 15.1 2017.20170520-lp151.12.3.1

opensuse advisories openSUSE-SU-2024:11431-1 openSUSE-SU-2024:11432-1 openSUSE-SU-2020:0804-1

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1159740 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.9	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

SUSE SUSE Linux Enterprise Module for Desktop Applications 15-SP1
SUSE SUSE Linux Enterprise Software Development Kit 12-SP4
SUSE SUSE Linux Enterprise Software Development Kit 12-SP5
openSUSE openSUSE Leap 15.1

Classification

Weakness

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

bugzilla.suse.com /show_bug.cgi?id=1159740
exploit, issue-tracking, vendor-advisory
lists.opensuse.org /opensuse-security-announce/2020-06/msg00021.html
vendor-advisory, mailing-list, third-party-advisory

Sources

CVE List CVE-2020-8016
NVD CVE-2020-8016

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary