CVE catalog

CVE-2019-3681

osc: CVE-2019-3681

Severity: Medium · CVSS 4.2CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Published: Jun 3, 2020, 12:21:54 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.39% · Oct 25, 2026

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	osc	sid	`1.15.1-1`	fixed
Debian	osc	forky	`1.15.1-1`	fixed
Debian	osc	trixie	`1.12.1-2`	fixed
Debian	osc	bookworm	`0.169.1-2`	fixed
Opensuse	osc	tumbleweed	`0.174.0-1.2`	fixed
Opensuse	osc	leap 15.1	`0.169.1-lp151.2.15.1`	fixed
Suse	osc	linux enterprise software development kit 12 sp5	`0.182.0-15.12.1`	fixed
Suse	osc	linux enterprise module for development tools 15 sp1	`0.169.1-3.20.1`	fixed
Suse	osc	linux enterprise software development kit 12 sp4	`0.162.1-15.9.1`	fixed
Suse	osc	linux enterprise software development kit 12 sp5	`0.162.1-15.9.1`	fixed
Suse	osc	linux enterprise module for development tools 15 sp2	`0.169.1-3.20.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	osc	source	sid	`0.169.1-1`	not yet assigned	Not reported	[969999]
Debian	osc	source	forky	`0.169.1-1`	not yet assigned	Not reported	[969999]
Debian	osc	source	trixie	`0.169.1-1`	not yet assigned	Not reported	[969999]
Debian	osc	source	bookworm	`0.169.1-1`	not yet assigned	Not reported	[969999]
Opensuse	osc	rpm	tumbleweed	`0.174.0-1.2`	Not reported	OPENSUSE-SU-2024:11133-1	Not reported
Opensuse	osc	rpm	leap 15.1	`0.169.1-lp151.2.15.1`	Not reported	OPENSUSE-SU-2020:0852-1	Not reported
Suse	osc	rpm	linux enterprise software development kit 12 sp5	`0.182.0-15.12.1`	Not reported	SUSE-SU-2022:4351-1	Not reported
Suse	osc	rpm	linux enterprise module for development tools 15 sp1	`0.169.1-3.20.1`	Not reported	SUSE-SU-2020:1695-1	Not reported
Suse	osc	rpm	linux enterprise software development kit 12 sp4	`0.162.1-15.9.1`	Not reported	SUSE-SU-2020:1528-1	Not reported
Suse	osc	rpm	linux enterprise software development kit 12 sp5	`0.162.1-15.9.1`	Not reported	SUSE-SU-2020:1528-1	Not reported
Suse	osc	rpm	linux enterprise module for development tools 15 sp2	`0.169.1-3.20.1`	Not reported	SUSE-SU-2020:1695-2	Not reported

[Debian bug #969999]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[osc]Fixed
Details (2)
- 0.169.1-2 · all · bookworm
  Fixed · Fixed: 0.169.1-1
  dsa · osc · debian · bookworm; dsa · osc · debian · 12
- 0.169.1-2 · all · bookworm
  Fixed · Fixed: 0.169.1-1
  dsa · osc · debian · bookworm; dsa · osc · debian · 12

[Debian 13 (Trixie)]

[osc]Fixed
Details (2)
- 1.12.1-2 · all · trixie
  Fixed · Fixed: 0.169.1-1
  dsa · osc · debian · 13
- 1.12.1-2 · all · trixie
  Fixed · Fixed: 0.169.1-1
  dsa · osc · debian · 13

[openSUSE Tumbleweed]

[osc]Fixed
Source package: [osc]
Details (1)
- 1.27.3-1.1 · noarch · tumbleweed
  Fixed · Fixed: 0.174.0-1.2
  dsa · osc · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:44:28 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]