| Package | Affected versions | Patched versions |
|---|---|---|
| backports sle | = 15.0 | |
| storebackup | ≤ 3.5 |
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free