CVE catalog

CVE-2018-12470

Security update for smt, yast2-smt

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.99% · Oct 25, 2026

This update for smt to 2.0.34 fixes the following issues: These security issues were fixed: - CVE-2018-12471: Xml External Entity processing in the RegistrationSharing modules allowed to read arbitrary file read (bsc#1103809) - CVE-2018-12470: SQL injection in RegistrationSharing module allows remote attackers to run arbitary SQL statements (bsc#1103810) - CVE-2018-12472: Authentication bypass in sibling check facilitated further attacks on SMT (bsc#1104076) SUSE would like to thank Jake Miller for reporting these issues to us. This non-security issue was fixed: - More verbose incomplete registration logging (bsc#1072921, bsc#1074608)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Susesmtsubscription management tool 11 sp32.0.34-50.8.1fixed
Susesmtlinux enterprise server 12 sp2-bcl3.0.37-52.23.6fixed
Susesmtopenstack cloud 73.0.37-52.23.6fixed
Suseperl-File-Touchlinux enterprise module for public cloud 120.11-3.2.2fixed
Susesmtlinux enterprise module for public cloud 123.0.37-52.23.6fixed
Susesmtlinux enterprise server for sap applications 12 sp13.0.37-52.23.6fixed
Suseyast2-smtlinux enterprise server for sap applications 12 sp13.0.14-10.6.2fixed
Susesmtlinux enterprise server for sap applications 12 sp23.0.37-52.23.6fixed
Susesmtlinux enterprise server 12 sp1-ltss3.0.37-52.23.6fixed
Suseyast2-smtlinux enterprise server 12 sp1-ltss3.0.14-10.6.2fixed
Susesmtlinux enterprise server 12 sp2-ltss3.0.37-52.23.6fixed
Susesmtlinux enterprise server 12 sp33.0.37-52.23.6fixed
Susesmtlinux enterprise server for sap applications 12 sp33.0.37-52.23.6fixed
Susesmtenterprise storage 43.0.37-52.23.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Susesmtrpmsubscription management tool 11 sp32.0.34-50.8.1Not reportedSUSE-SU-2018:2899-1Not reported
Susesmtrpmlinux enterprise server 12 sp2-bcl3.0.37-52.23.6Not reportedSUSE-SU-2018:2898-2Not reported
Susesmtrpmopenstack cloud 73.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Suseperl-File-Touchrpmlinux enterprise module for public cloud 120.11-3.2.2Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise module for public cloud 123.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise server for sap applications 12 sp13.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Suseyast2-smtrpmlinux enterprise server for sap applications 12 sp13.0.14-10.6.2Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise server for sap applications 12 sp23.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise server 12 sp1-ltss3.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Suseyast2-smtrpmlinux enterprise server 12 sp1-ltss3.0.14-10.6.2Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise server 12 sp2-ltss3.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise server 12 sp33.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmlinux enterprise server for sap applications 12 sp33.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported
Susesmtrpmenterprise storage 43.0.37-52.23.6Not reportedSUSE-SU-2018:2898-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]