Opensuse Tumbleweed vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Opensuse Tumbleweed: 5 record(s), with affected versions and fixes.cpe:2.3:o:opensuse:tumbleweed
CVE-2026-104618
Medium · 6.2
CWE-732 Oct 15, 2026
sdbootutil: world-readable debug log
On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.
CVE-2026-104617
Medium · 5.1
CWE-522 Oct 15, 2026
sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.
CVE-2025-62875
Medium · 5.5
CWE-754 Nov 20, 2025
Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock
An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD.
This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
CVE-2025-53881
Medium · 6.9
CWE-61 Oct 2, 2025
SUSE-specific logrotate configuration allows escalation from mail user/group to root
A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.
CVE-2015-3306
Critical · 10.0
KEV Urgent · 83 Public exploit CWE-284 May 18, 2015
ProFTPD Improper Access Control Vulnerability
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.