Static tempfile name allows overwriting of arbitrary files

published 2019-03-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-9696

cvss: 2.2; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection

Patch / fix

fixed in 1 distros 2

SUSE yast2-multipath 4.1.1

suse opensuse

yast2-multipath SLE High Availability Extension 12 SP2 3.1.9-12.3.45
yast2-multipath SLE High Availability Extension 12 SP5, SLE High Availability Extension 12 SP4, SLE High Availability Extension 12 SP3 3.2.2-3.3.30

suse advisories SUSE-SU-2021:0182-1 SUSE-SU-2020:3231-1

yast2-multipath openSUSE Tumbleweed 4.4.1-1.2

opensuse advisories openSUSE-SU-2024:11533-1

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	2.2	CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
NVD	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	3.6	AV:L/AC:L/Au:N/C:N/I:P/A:P

Affected products

SUSE yast2-multipath

Classification

Weakness

CWE-377 DEPRECATED: Insecure Temporary File
CWE-59 Improper Link Resolution Before File Access

References

bugzilla.suse.com /show_bug.cgi?id=1117592

Sources

CVE List CVE-2018-17955
NVD CVE-2018-17955

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary