CVE-2016-1601

Published: Apr 26, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.

Affected (1)

Products: Suse: Yast2

1 product

Configuration A

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Suse Yast2	All versions

Running on/with	Platform Versions
Suse Linux Enterprise Desktop	Version 12 sp1
Suse Linux Enterprise Server	Version 12 sp1
Suse Linux Enterprise Software Development Kit	Version 12 sp1

Related CWEs

References (8)

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00051.html

Source: security@opentext.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00007.html

Source: security@opentext.com

https://bugzilla.suse.com/show_bug.cgi?id=974220

Source: security@opentext.com

https://build.opensuse.org/request/show/388020

Source: security@opentext.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00051.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.suse.com/show_bug.cgi?id=974220

Source: af854a3a-2127-422b-91ae-364da2661108

https://build.opensuse.org/request/show/388020

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.