CVE-2018-17955 - CVE House

Status published Low CVE-2018-17955

Static tempfile name allows overwriting of arbitrary files

2.2 CVSS

Vulnerability Description

In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-17955

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Johannes Segitz of SUSE

References

https://bugzilla.suse.com/show_bug.cgi?id=1117592

More from SUSE

View All →

CVE-2025-8412

VMDP: Potential buffer overflow in the RtlQueryRegistryValues function

Low 2

CVE-2025-8077

NeuVector admin account has insecure default password

Critical 9.8

CVE-2025-71261

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

High 8.6

CVE-2025-67860

NeuVector scanner insecurely handles passwords as command arguments

Low 3.8

CVE-2025-67601

Rancher CLI skips TLS verification on Rancher CLI login command

High 8.3

Affected Vendor

SUSE

View all reports →

Affected Software

yast2-multipath

Vulnerable Versions:

unspecified

Timeline

Official Publish: March 15th, 2019

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-377

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.