CVE-2016-1602

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-23 · updated 2026-06-17
Weakness: CWE-94

Description

A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root).

Affected products

SUSE Linux Enterprise Server 15 SP1: 12, 12-sp1
SUSE Linux Enterprise Server: 12-sp1
SUSE Linux Enterprise: 12

References

http://lists.suse.com/pipermail/sle-security-updates/2016-June/002096.html
http://lists.suse.com/pipermail/sle-security-updates/2016-June/002096.html

Get alerted when CVE-2016-1602 or the next vulnerability affects your stack