Descrizioni CVE

yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.

Informazioni CVE

Vulnerabilità correlate

CWE-ID	Nome della vulnerabilità	Fonte
CWE-78	Improper Neutralization of Special Elements used in an OS Command The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

Metriche

Metriche	Punteggio	Gravità	CVSS Vettore	Fonte
V2	7.2		AV:L/AC:L/Au:N/C:C/I:C/A:C	nvd@nist.gov

EPSS

EPSS è un modello di punteggio che prevede la probabilità che una vulnerabilità venga sfruttata.

Punteggio EPSS

Il modello EPSS produce un punteggio di probabilità compreso tra 0 e 1 (da 0 a 100%). Più alto è il punteggio, maggiore è la probabilità che una vulnerabilità venga sfruttata.

Percentile EPSS

Il percentile viene utilizzato per classificare le CVE in base al loro punteggio EPSS. Ad esempio, una CVE al 95° percentile secondo il suo punteggio EPSS ha una probabilità maggiore di essere sfruttata rispetto al 95% delle altre CVE. Il percentile consente quindi di confrontare il punteggio EPSS di una CVE con quello delle altre.

EPSS First.org

Prodotti menzionati

Configurazione 0

Novell>>Linux_desktop >> Version 9

Novell>>Open_enterprise_server >> Version -

Opensuse>>Opensuse >> Version 10.2

Opensuse>>Opensuse >> Version 10.3

Opensuse>>Opensuse >> Version 11.0

Suse>>Linux_enterprise_server >> Version 8

Suse>>Linux_enterprise_server >> Version 9

Suse>>Suse_linux_enterprise_desktop >> Version 10

Suse>>Suse_linux_enterprise_server >> Version 10

Suse>>Yast2-backup >> Version Da (incluso) 2.14.2 A (incluso) 2.16.6

Riferimenti

http://www.securityfocus.com/bid/32464
Tags : vdb-entry, x_refsource_BID

http://secunia.com/advisories/32832
Tags : third-party-advisory, x_refsource_SECUNIA

http://osvdb.org/50284
Tags : vdb-entry, x_refsource_OSVDB

https://exchange.xforce.ibmcloud.com/vulnerabilities/46879
Tags : vdb-entry, x_refsource_XF

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html
Tags : vendor-advisory, x_refsource_SUSE

Data	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	0.95%	–	–
2022-02-13	–	–	0.95%	–	–
2022-03-20	–	–	0.95%	–	–
2022-04-03	–	–	0.95%	–	–
2022-06-19	–	–	0.95%	–	–
2022-09-04	–	–	0.95%	–	–
2022-12-18	–	–	0.95%	–	–
2023-03-12	–	–	–	0.04%	–
2024-02-11	–	–	–	0.04%	–
2024-02-18	–	–	–	0.04%	–
2024-04-07	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-10-27	–	–	–	0.04%	–
2024-12-15	–	–	–	0.04%	–
2024-12-22	–	–	–	0.17%	–
2025-01-19	–	–	–	0.17%	–
2025-03-09	–	–	–	0.17%	–
2025-03-09	–	–	–	0.17%	–
2025-03-18	–	–	–	–	0.19%
2025-03-30	–	–	–	–	0.19%
2025-04-15	–	–	–	–	0.19%
2025-04-29	–	–	–	–	0.19%
2025-04-30	–	–	–	–	0.19%
2025-06-19	–	–	–	–	0.19%
2025-07-01	–	–	–	–	0.19%
2025-07-04	–	–	–	–	0.19%
2025-07-10	–	–	–	–	0.19%
2025-07-12	–	–	–	–	0.19%
2025-08-01	–	–	–	–	0.19%
2025-08-04	–	–	–	–	0.19%
2025-11-18	–	–	–	–	0.19%
2025-11-21	–	–	–	–	0.19%

Data	Percentile
2022-02-06	13%
2022-02-13	14%
2022-03-20	15%
2022-04-03	29%
2022-06-19	3%
2022-09-04	31%
2022-12-18	32%
2023-03-12	6%
2024-02-11	7%
2024-02-18	8%
2024-04-07	9%
2024-06-02	1%
2024-10-27	11%
2024-12-15	12%
2024-12-22	55%
2025-01-19	55%
2025-03-09	56%
2025-03-09	56%
2025-03-18	39%
2025-03-30	38%
2025-04-15	42%
2025-04-29	41%
2025-04-30	42%
2025-06-19	41%
2025-07-01	42%
2025-07-04	41%
2025-07-10	42%
2025-07-12	41%
2025-08-01	42%
2025-08-04	41%
2025-11-18	36%
2025-11-21	41%

CVE-2008-4636 : Dettaglio

CVE-2008-4636