Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

openSUSE 15.5: 2023:3859-1 Moderate: pmix User-Linked Chown Threat

opensuse
Calendar Grey September 28, 2023
Scroller Opensuse
The latest pmix update tackles a potential vulnerability concerning user-generated links, reinforcing overall security measures.
This update for pmix fixes the following issues: CVE-2023-41915: Fixed a potential vulnerability where a `chown` may follow a user-created link (bsc#1215190).

Description

This update for pmix fixes the following issues:

* CVE-2023-41915: Fixed a potential vulnerability where a `chown` may follow a

user-created link (bsc#1215190).

* Install pmix-plugin-munge if munge is installed.

Topics%20covered

Topics Covered

security advisory moderate threat patch management openSUSE pmix user-linked chown

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch openSUSE-SLE-15.4-2023-3859=1

* openSUSE Leap 15.5

zypper in -t patch openSUSE-SLE-15.5-2023-3859=1

* HPC Module 15-SP4

zypper in -t patch SUSE-SLE-Module-HPC-15-SP4-2023-3859=1

* HPC Module 15-SP5

zypper in -t patch SUSE-SLE-Module-HPC-15-SP5-2023-3859=1

Package List

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)

* libpmix2-debuginfo-3.2.3-150300.3.8.1

* pmix-3.2.3-150300.3.8.1

* pmix-plugins-3.2.3-150300.3.8.1

* pmix-plugin-munge-3.2.3-150300.3.8.1

* pmix-test-debuginfo-3.2.3-150300.3.8.1

* pmix-plugins-debuginfo-3.2.3-150300.3.8.1

* libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1

* pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1

* pmix-test-3.2.3-150300.3.8.1

* libpmix2-3.2.3-150300.3.8.1

* libmca_common_dstore1-3.2.3-150300.3.8.1

* pmix-debuginfo-3.2.3-150300.3.8.1

* pmix-debugsource-3.2.3-150300.3.8.1

* pmix-devel-3.2.3-150300.3.8.1

* openSUSE Leap 15.4 (noarch)

* pmix-headers-3.2.3-150300.3.8.1

* pmix-mca-params-3.2.3-150300.3.8.1

* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

* libpmix2-debuginfo-3.2.3-150300.3.8.1

* pmix-3.2.3-150300.3.8.1

* pmix-plugins-3.2.3-150300.3.8.1

* pmix-plugin-munge-3.2.3-150300.3.8.1

* pmix-test-debuginfo-3.2.3-150300.3.8.1

* pmix-plugins-debuginfo-3.2.3-150300.3.8.1

* libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1

*...

Read the Full Advisory

References

* #1215190

## References:

* https://www.suse.com/security/cve/CVE-2023-41915.html

* https://bugzilla.suse.com/show_bug.cgi?id=1215190

Announcement ID: SUSE-SU-2023:3859-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate threat patch management openSUSE pmix user-linked chown

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.