SUSE update for brise
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2024-45337 CVE-2025-21613 |
| CWE-ID | CWE-285 CWE-88 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
Desktop Applications Module Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system rime-schema-extra Operating systems & Components / Operating system package or component rime-schema-stroke Operating systems & Components / Operating system package or component rime-schema-cangjie Operating systems & Components / Operating system package or component rime-schema-prelude Operating systems & Components / Operating system package or component rime-schema-middle-chinese Operating systems & Components / Operating system package or component rime-schema-combo-pinyin Operating systems & Components / Operating system package or component rime-schema-array Operating systems & Components / Operating system package or component rime-schema-double-pinyin Operating systems & Components / Operating system package or component rime-schema-all Operating systems & Components / Operating system package or component rime-schema-scj Operating systems & Components / Operating system package or component rime-schema-ipa Operating systems & Components / Operating system package or component rime-schema-essay Operating systems & Components / Operating system package or component rime-schema-essay-simp Operating systems & Components / Operating system package or component rime-schema-custom Operating systems & Components / Operating system package or component rime-schema-quick Operating systems & Components / Operating system package or component rime-schema-default Operating systems & Components / Operating system package or component rime-schema-cantonese Operating systems & Components / Operating system package or component rime-schema-terra-pinyin Operating systems & Components / Operating system package or component rime-schema-pinyin-simp Operating systems & Components / Operating system package or component rime-schema-stenotype Operating systems & Components / Operating system package or component rime-schema-wubi Operating systems & Components / Operating system package or component rime-schema-luna-pinyin Operating systems & Components / Operating system package or component rime-schema-wugniu Operating systems & Components / Operating system package or component rime-schema-bopomofo Operating systems & Components / Operating system package or component rime-schema-emoji Operating systems & Components / Operating system package or component rime-schema-soutzoe Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Improper authorization
EUVDB-ID: #VU101777
Risk: Medium
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2024-45337
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to the application.
The vulnerability exists due to improper authorization caused by improper usage of the ServerConfig.PublicKeyCallback callback. A remote attacker can bypass authorization in certain cases and gain access to the application.
Update the affected package brise to the latest version.
Vulnerable software versionsDesktop Applications Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP6
SUSE Linux Enterprise Server 15: SP6
SUSE Linux Enterprise Desktop 15: SP6
rime-schema-extra: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-stroke: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-cangjie: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-prelude: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-middle-chinese: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-combo-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-array: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-double-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-all: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-scj: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-ipa: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-essay: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-essay-simp: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-custom: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-quick: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-default: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-cantonese: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-terra-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-pinyin-simp: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-stenotype: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-wubi: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-luna-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-wugniu: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-bopomofo: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-emoji: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-soutzoe: before 20230603+git.5fdd2d6-150600.3.8.1
CPE2.3- cpe:2.3:o:suse:desktop_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:rime-schema-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-stroke:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-cangjie:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-prelude:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-middle-chinese:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-combo-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-array:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-double-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-all:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-scj:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-ipa:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-essay:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-essay-simp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-custom:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-quick:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-cantonese:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-terra-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-pinyin-simp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-stenotype:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-wubi:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-luna-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-wugniu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-bopomofo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-emoji:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-soutzoe:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250601-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Improper neutralization of argument delimiters in a command
EUVDB-ID: #VU103421
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-21613
CWE-ID:
CWE-88 - Argument Injection or Modification
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation when handling URL field in arguments passed to the git-upload-pack command. A remote attacker can trick the victim into passing a specially crafted URL as a flag to the affected command and manipulate arguments for the git-upload-pack command, which can result in information disclosure.
Update the affected package brise to the latest version.
Vulnerable software versionsDesktop Applications Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP6
SUSE Linux Enterprise Server 15: SP6
SUSE Linux Enterprise Desktop 15: SP6
rime-schema-extra: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-stroke: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-cangjie: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-prelude: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-middle-chinese: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-combo-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-array: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-double-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-all: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-scj: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-ipa: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-essay: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-essay-simp: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-custom: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-quick: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-default: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-cantonese: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-terra-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-pinyin-simp: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-stenotype: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-wubi: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-luna-pinyin: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-wugniu: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-bopomofo: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-emoji: before 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-soutzoe: before 20230603+git.5fdd2d6-150600.3.8.1
CPE2.3- cpe:2.3:o:suse:desktop_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:rime-schema-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-stroke:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-cangjie:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-prelude:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-middle-chinese:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-combo-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-array:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-double-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-all:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-scj:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-ipa:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-essay:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-essay-simp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-custom:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-quick:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-cantonese:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-terra-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-pinyin-simp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-stenotype:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-wubi:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-luna-pinyin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-wugniu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-bopomofo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-emoji:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:rime-schema-soutzoe:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250601-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
