What’s Vulnerable › Vulnerabilities

CVE-2018-17955: Static tempfile name allows overwriting of arbitrary files

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-15 · updated 2026-06-17
• Weakness: CWE-377

Description

In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection

Affected products

• SUSE yast2-multipath: before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: SUSE yast2-multipath 4.1.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1117592
• https://bugzilla.suse.com/show_bug.cgi?id=1117592

Get alerted when CVE-2018-17955 or the next vulnerability affects your stack