Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2022-23853 CVE-2022-25255 |
CWE-ID | CWE-426 CWE-94 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software |
SUSE Linux Enterprise Realtime Extension Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Module for Desktop Applications Operating systems & Components / Operating system SUSE Linux Enterprise Module for Basesystem Operating systems & Components / Operating system libqt5-qtbase-private-headers-devel Operating systems & Components / Operating system package or component libQt5Widgets-private-headers-devel Operating systems & Components / Operating system package or component libQt5Test-private-headers-devel Operating systems & Components / Operating system package or component libQt5Sql-private-headers-devel Operating systems & Components / Operating system package or component libQt5PrintSupport-private-headers-devel Operating systems & Components / Operating system package or component libQt5PlatformSupport-private-headers-devel Operating systems & Components / Operating system package or component libQt5OpenGL-private-headers-devel Operating systems & Components / Operating system package or component libQt5Network-private-headers-devel Operating systems & Components / Operating system package or component libQt5KmsSupport-private-headers-devel Operating systems & Components / Operating system package or component libQt5Gui-private-headers-devel Operating systems & Components / Operating system package or component libQt5DBus-private-headers-devel Operating systems & Components / Operating system package or component libQt5Core-private-headers-devel Operating systems & Components / Operating system package or component libqt5-qtbase-platformtheme-gtk3-debuginfo Operating systems & Components / Operating system package or component libqt5-qtbase-platformtheme-gtk3 Operating systems & Components / Operating system package or component libqt5-qtbase-devel Operating systems & Components / Operating system package or component libqt5-qtbase-debugsource Operating systems & Components / Operating system package or component libqt5-qtbase-common-devel-debuginfo Operating systems & Components / Operating system package or component libqt5-qtbase-common-devel Operating systems & Components / Operating system package or component libQt5Xml5-debuginfo Operating systems & Components / Operating system package or component libQt5Xml5 Operating systems & Components / Operating system package or component libQt5Xml-devel Operating systems & Components / Operating system package or component libQt5Widgets5-debuginfo Operating systems & Components / Operating system package or component libQt5Widgets5 Operating systems & Components / Operating system package or component libQt5Widgets-devel Operating systems & Components / Operating system package or component libQt5Test5-debuginfo Operating systems & Components / Operating system package or component libQt5Test5 Operating systems & Components / Operating system package or component libQt5Test-devel Operating systems & Components / Operating system package or component libQt5Sql5-unixODBC-debuginfo Operating systems & Components / Operating system package or component libQt5Sql5-unixODBC Operating systems & Components / Operating system package or component libQt5Sql5-sqlite-debuginfo Operating systems & Components / Operating system package or component libQt5Sql5-sqlite Operating systems & Components / Operating system package or component libQt5Sql5-postgresql-debuginfo Operating systems & Components / Operating system package or component libQt5Sql5-postgresql Operating systems & Components / Operating system package or component libQt5Sql5-mysql-debuginfo Operating systems & Components / Operating system package or component libQt5Sql5-mysql Operating systems & Components / Operating system package or component libQt5Sql5-debuginfo Operating systems & Components / Operating system package or component libQt5Sql5 Operating systems & Components / Operating system package or component libQt5Sql-devel Operating systems & Components / Operating system package or component libQt5PrintSupport5-debuginfo Operating systems & Components / Operating system package or component libQt5PrintSupport5 Operating systems & Components / Operating system package or component libQt5PrintSupport-devel Operating systems & Components / Operating system package or component libQt5PlatformSupport-devel-static Operating systems & Components / Operating system package or component libQt5PlatformHeaders-devel Operating systems & Components / Operating system package or component libQt5OpenGLExtensions-devel-static Operating systems & Components / Operating system package or component libQt5OpenGL5-debuginfo Operating systems & Components / Operating system package or component libQt5OpenGL5 Operating systems & Components / Operating system package or component libQt5OpenGL-devel Operating systems & Components / Operating system package or component libQt5Network5-debuginfo Operating systems & Components / Operating system package or component libQt5Network5 Operating systems & Components / Operating system package or component libQt5Network-devel Operating systems & Components / Operating system package or component libQt5KmsSupport-devel-static Operating systems & Components / Operating system package or component libQt5Gui5-debuginfo Operating systems & Components / Operating system package or component libQt5Gui5 Operating systems & Components / Operating system package or component libQt5Gui-devel Operating systems & Components / Operating system package or component libQt5DBus5-debuginfo Operating systems & Components / Operating system package or component libQt5DBus5 Operating systems & Components / Operating system package or component libQt5DBus-devel-debuginfo Operating systems & Components / Operating system package or component libQt5DBus-devel Operating systems & Components / Operating system package or component libQt5Core5-debuginfo Operating systems & Components / Operating system package or component libQt5Core5 Operating systems & Components / Operating system package or component libQt5Core-devel Operating systems & Components / Operating system package or component libQt5Concurrent5-debuginfo Operating systems & Components / Operating system package or component libQt5Concurrent5 Operating systems & Components / Operating system package or component libQt5Concurrent-devel Operating systems & Components / Operating system package or component |
Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU60188
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-23853
CWE-ID:
CWE-426 - Untrusted Search Path
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the way application searches for executable files. A local user can place a malicious binary file into a current working directory, trick the victim into running the application and execute arbitrary code with elevated privileges.
Update the affected package libqt5-qtbase to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Realtime Extension: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Server: 4.1 - 4.2
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1 - 4.2
SUSE Linux Enterprise Server for SAP: 15-SP2
SUSE Linux Enterprise Desktop: 15-SP3
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
SUSE Linux Enterprise Module for Desktop Applications: 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP3
libqt5-qtbase-private-headers-devel: before 5.12.7-4.17.1
libQt5Widgets-private-headers-devel: before 5.12.7-4.17.1
libQt5Test-private-headers-devel: before 5.12.7-4.17.1
libQt5Sql-private-headers-devel: before 5.12.7-4.17.1
libQt5PrintSupport-private-headers-devel: before 5.12.7-4.17.1
libQt5PlatformSupport-private-headers-devel: before 5.12.7-4.17.1
libQt5OpenGL-private-headers-devel: before 5.12.7-4.17.1
libQt5Network-private-headers-devel: before 5.12.7-4.17.1
libQt5KmsSupport-private-headers-devel: before 5.12.7-4.17.1
libQt5Gui-private-headers-devel: before 5.12.7-4.17.1
libQt5DBus-private-headers-devel: before 5.12.7-4.17.1
libQt5Core-private-headers-devel: before 5.12.7-4.17.1
libqt5-qtbase-platformtheme-gtk3-debuginfo: before 5.12.7-4.17.1
libqt5-qtbase-platformtheme-gtk3: before 5.12.7-4.17.1
libqt5-qtbase-devel: before 5.12.7-4.17.1
libqt5-qtbase-debugsource: before 5.12.7-4.17.1
libqt5-qtbase-common-devel-debuginfo: before 5.12.7-4.17.1
libqt5-qtbase-common-devel: before 5.12.7-4.17.1
libQt5Xml5-debuginfo: before 5.12.7-4.17.1
libQt5Xml5: before 5.12.7-4.17.1
libQt5Xml-devel: before 5.12.7-4.17.1
libQt5Widgets5-debuginfo: before 5.12.7-4.17.1
libQt5Widgets5: before 5.12.7-4.17.1
libQt5Widgets-devel: before 5.12.7-4.17.1
libQt5Test5-debuginfo: before 5.12.7-4.17.1
libQt5Test5: before 5.12.7-4.17.1
libQt5Test-devel: before 5.12.7-4.17.1
libQt5Sql5-unixODBC-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-unixODBC: before 5.12.7-4.17.1
libQt5Sql5-sqlite-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-sqlite: before 5.12.7-4.17.1
libQt5Sql5-postgresql-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-postgresql: before 5.12.7-4.17.1
libQt5Sql5-mysql-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-mysql: before 5.12.7-4.17.1
libQt5Sql5-debuginfo: before 5.12.7-4.17.1
libQt5Sql5: before 5.12.7-4.17.1
libQt5Sql-devel: before 5.12.7-4.17.1
libQt5PrintSupport5-debuginfo: before 5.12.7-4.17.1
libQt5PrintSupport5: before 5.12.7-4.17.1
libQt5PrintSupport-devel: before 5.12.7-4.17.1
libQt5PlatformSupport-devel-static: before 5.12.7-4.17.1
libQt5PlatformHeaders-devel: before 5.12.7-4.17.1
libQt5OpenGLExtensions-devel-static: before 5.12.7-4.17.1
libQt5OpenGL5-debuginfo: before 5.12.7-4.17.1
libQt5OpenGL5: before 5.12.7-4.17.1
libQt5OpenGL-devel: before 5.12.7-4.17.1
libQt5Network5-debuginfo: before 5.12.7-4.17.1
libQt5Network5: before 5.12.7-4.17.1
libQt5Network-devel: before 5.12.7-4.17.1
libQt5KmsSupport-devel-static: before 5.12.7-4.17.1
libQt5Gui5-debuginfo: before 5.12.7-4.17.1
libQt5Gui5: before 5.12.7-4.17.1
libQt5Gui-devel: before 5.12.7-4.17.1
libQt5DBus5-debuginfo: before 5.12.7-4.17.1
libQt5DBus5: before 5.12.7-4.17.1
libQt5DBus-devel-debuginfo: before 5.12.7-4.17.1
libQt5DBus-devel: before 5.12.7-4.17.1
libQt5Core5-debuginfo: before 5.12.7-4.17.1
libQt5Core5: before 5.12.7-4.17.1
libQt5Core-devel: before 5.12.7-4.17.1
libQt5Concurrent5-debuginfo: before 5.12.7-4.17.1
libQt5Concurrent5: before 5.12.7-4.17.1
libQt5Concurrent-devel: before 5.12.7-4.17.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20220841-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU61830
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-25255
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to QProcess can execute a binary from the current working directory when not found in the PATH. A local user can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package libqt5-qtbase to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Realtime Extension: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Server: 4.1 - 4.2
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1 - 4.2
SUSE Linux Enterprise Server for SAP: 15-SP2
SUSE Linux Enterprise Desktop: 15-SP3
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
SUSE Linux Enterprise Module for Desktop Applications: 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP3
libqt5-qtbase-private-headers-devel: before 5.12.7-4.17.1
libQt5Widgets-private-headers-devel: before 5.12.7-4.17.1
libQt5Test-private-headers-devel: before 5.12.7-4.17.1
libQt5Sql-private-headers-devel: before 5.12.7-4.17.1
libQt5PrintSupport-private-headers-devel: before 5.12.7-4.17.1
libQt5PlatformSupport-private-headers-devel: before 5.12.7-4.17.1
libQt5OpenGL-private-headers-devel: before 5.12.7-4.17.1
libQt5Network-private-headers-devel: before 5.12.7-4.17.1
libQt5KmsSupport-private-headers-devel: before 5.12.7-4.17.1
libQt5Gui-private-headers-devel: before 5.12.7-4.17.1
libQt5DBus-private-headers-devel: before 5.12.7-4.17.1
libQt5Core-private-headers-devel: before 5.12.7-4.17.1
libqt5-qtbase-platformtheme-gtk3-debuginfo: before 5.12.7-4.17.1
libqt5-qtbase-platformtheme-gtk3: before 5.12.7-4.17.1
libqt5-qtbase-devel: before 5.12.7-4.17.1
libqt5-qtbase-debugsource: before 5.12.7-4.17.1
libqt5-qtbase-common-devel-debuginfo: before 5.12.7-4.17.1
libqt5-qtbase-common-devel: before 5.12.7-4.17.1
libQt5Xml5-debuginfo: before 5.12.7-4.17.1
libQt5Xml5: before 5.12.7-4.17.1
libQt5Xml-devel: before 5.12.7-4.17.1
libQt5Widgets5-debuginfo: before 5.12.7-4.17.1
libQt5Widgets5: before 5.12.7-4.17.1
libQt5Widgets-devel: before 5.12.7-4.17.1
libQt5Test5-debuginfo: before 5.12.7-4.17.1
libQt5Test5: before 5.12.7-4.17.1
libQt5Test-devel: before 5.12.7-4.17.1
libQt5Sql5-unixODBC-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-unixODBC: before 5.12.7-4.17.1
libQt5Sql5-sqlite-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-sqlite: before 5.12.7-4.17.1
libQt5Sql5-postgresql-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-postgresql: before 5.12.7-4.17.1
libQt5Sql5-mysql-debuginfo: before 5.12.7-4.17.1
libQt5Sql5-mysql: before 5.12.7-4.17.1
libQt5Sql5-debuginfo: before 5.12.7-4.17.1
libQt5Sql5: before 5.12.7-4.17.1
libQt5Sql-devel: before 5.12.7-4.17.1
libQt5PrintSupport5-debuginfo: before 5.12.7-4.17.1
libQt5PrintSupport5: before 5.12.7-4.17.1
libQt5PrintSupport-devel: before 5.12.7-4.17.1
libQt5PlatformSupport-devel-static: before 5.12.7-4.17.1
libQt5PlatformHeaders-devel: before 5.12.7-4.17.1
libQt5OpenGLExtensions-devel-static: before 5.12.7-4.17.1
libQt5OpenGL5-debuginfo: before 5.12.7-4.17.1
libQt5OpenGL5: before 5.12.7-4.17.1
libQt5OpenGL-devel: before 5.12.7-4.17.1
libQt5Network5-debuginfo: before 5.12.7-4.17.1
libQt5Network5: before 5.12.7-4.17.1
libQt5Network-devel: before 5.12.7-4.17.1
libQt5KmsSupport-devel-static: before 5.12.7-4.17.1
libQt5Gui5-debuginfo: before 5.12.7-4.17.1
libQt5Gui5: before 5.12.7-4.17.1
libQt5Gui-devel: before 5.12.7-4.17.1
libQt5DBus5-debuginfo: before 5.12.7-4.17.1
libQt5DBus5: before 5.12.7-4.17.1
libQt5DBus-devel-debuginfo: before 5.12.7-4.17.1
libQt5DBus-devel: before 5.12.7-4.17.1
libQt5Core5-debuginfo: before 5.12.7-4.17.1
libQt5Core5: before 5.12.7-4.17.1
libQt5Core-devel: before 5.12.7-4.17.1
libQt5Concurrent5-debuginfo: before 5.12.7-4.17.1
libQt5Concurrent5: before 5.12.7-4.17.1
libQt5Concurrent-devel: before 5.12.7-4.17.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20220841-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.