A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root).
| Software | From | Fixed in |
|---|---|---|
| suse / linux_enterprise_server | 12-sp1 | 12-sp1.x |
| suse / linux_enterprise_desktop | 12 | 12.x |
| suse / linux_enterprise_desktop | 12-sp1 | 12-sp1.x |
| suse / suse_linux_enterprise_server | 12 | 12.x |