Static temporary filename allows overwriting of files

published 2019-03-05 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11322

cvss: 2.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

Patch / fix

fixed in 1 distros 2

SUSE supportutils 3.1-5.7.1

suse opensuse

supportutils SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +10 more 3.0-95.21.1
hostinfo SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +8 more 1.0.1-19.5.1
supportutils SLE Module for Basesystem 15 3.1-5.7.1

suse advisories SUSE-SU-2019:1122-1 SUSE-SU-2019:0480-1

supportutils openSUSE Tumbleweed 3.1.17-2.2

opensuse advisories openSUSE-SU-2024:11415-1

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	2.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
NVD	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	3.6	AV:L/AC:L/Au:N/C:N/I:P/A:P

Affected products

SUSE supportutils

Classification

Weakness

CWE-377 DEPRECATED: Insecure Temporary File
CWE-59 Improper Link Resolution Before File Access

References

Sources

CVE List CVE-2018-19637
NVD CVE-2018-19637

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary