opensuse-su-2024:10860-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
ikiwiki-3.20200202.3-2.7 on GA media

Notes

Title of the patch
ikiwiki-3.20200202.3-2.7 on GA media
Description of the patch
These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10860
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ikiwiki-3.20200202.3-2.7 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10860",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10860-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2008-0169 page",
        "url": "https://www.suse.com/security/cve/CVE-2008-0169/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2009-2944 page",
        "url": "https://www.suse.com/security/cve/CVE-2009-2944/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2011-0428 page",
        "url": "https://www.suse.com/security/cve/CVE-2011-0428/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2011-1401 page",
        "url": "https://www.suse.com/security/cve/CVE-2011-1401/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2012-0220 page",
        "url": "https://www.suse.com/security/cve/CVE-2012-0220/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1572 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1572/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10026 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10026/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1238 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1238/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-3714 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-3714/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-4561 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-4561/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9645 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9645/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9646 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9646/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-0356 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-0356/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9187 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9187/"
      }
    ],
    "title": "ikiwiki-3.20200202.3-2.7 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10860-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ikiwiki-3.20200202.3-2.7.aarch64",
                "product": {
                  "name": "ikiwiki-3.20200202.3-2.7.aarch64",
                  "product_id": "ikiwiki-3.20200202.3-2.7.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "ikiwiki-w3m-3.20200202.3-2.7.aarch64",
                "product": {
                  "name": "ikiwiki-w3m-3.20200202.3-2.7.aarch64",
                  "product_id": "ikiwiki-w3m-3.20200202.3-2.7.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ikiwiki-3.20200202.3-2.7.ppc64le",
                "product": {
                  "name": "ikiwiki-3.20200202.3-2.7.ppc64le",
                  "product_id": "ikiwiki-3.20200202.3-2.7.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
                "product": {
                  "name": "ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
                  "product_id": "ikiwiki-w3m-3.20200202.3-2.7.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ikiwiki-3.20200202.3-2.7.s390x",
                "product": {
                  "name": "ikiwiki-3.20200202.3-2.7.s390x",
                  "product_id": "ikiwiki-3.20200202.3-2.7.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "ikiwiki-w3m-3.20200202.3-2.7.s390x",
                "product": {
                  "name": "ikiwiki-w3m-3.20200202.3-2.7.s390x",
                  "product_id": "ikiwiki-w3m-3.20200202.3-2.7.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ikiwiki-3.20200202.3-2.7.x86_64",
                "product": {
                  "name": "ikiwiki-3.20200202.3-2.7.x86_64",
                  "product_id": "ikiwiki-3.20200202.3-2.7.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "ikiwiki-w3m-3.20200202.3-2.7.x86_64",
                "product": {
                  "name": "ikiwiki-w3m-3.20200202.3-2.7.x86_64",
                  "product_id": "ikiwiki-w3m-3.20200202.3-2.7.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-3.20200202.3-2.7.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64"
        },
        "product_reference": "ikiwiki-3.20200202.3-2.7.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-3.20200202.3-2.7.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le"
        },
        "product_reference": "ikiwiki-3.20200202.3-2.7.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-3.20200202.3-2.7.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x"
        },
        "product_reference": "ikiwiki-3.20200202.3-2.7.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-3.20200202.3-2.7.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64"
        },
        "product_reference": "ikiwiki-3.20200202.3-2.7.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-w3m-3.20200202.3-2.7.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64"
        },
        "product_reference": "ikiwiki-w3m-3.20200202.3-2.7.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-w3m-3.20200202.3-2.7.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le"
        },
        "product_reference": "ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-w3m-3.20200202.3-2.7.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x"
        },
        "product_reference": "ikiwiki-w3m-3.20200202.3-2.7.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ikiwiki-w3m-3.20200202.3-2.7.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        },
        "product_reference": "ikiwiki-w3m-3.20200202.3-2.7.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2008-0169",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2008-0169"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2008-0169",
          "url": "https://www.suse.com/security/cve/CVE-2008-0169"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2008-0169"
    },
    {
      "cve": "CVE-2009-2944",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2009-2944"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers to read arbitrary files via crafted TeX commands.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2009-2944",
          "url": "https://www.suse.com/security/cve/CVE-2009-2944"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2009-2944"
    },
    {
      "cve": "CVE-2011-0428",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2011-0428"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2011-0428",
          "url": "https://www.suse.com/security/cve/CVE-2011-0428"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2011-0428"
    },
    {
      "cve": "CVE-2011-1401",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2011-1401"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the \"meta stylesheet\" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2011-1401",
          "url": "https://www.suse.com/security/cve/CVE-2011-1401"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2011-1401"
    },
    {
      "cve": "CVE-2012-0220",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2012-0220"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the (1) author or (2) authorurl meta tags.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2012-0220",
          "url": "https://www.suse.com/security/cve/CVE-2012-0220"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2012-0220"
    },
    {
      "cve": "CVE-2014-1572",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1572"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1572",
          "url": "https://www.suse.com/security/cve/CVE-2014-1572"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1572"
    },
    {
      "cve": "CVE-2016-10026",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10026"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10026",
          "url": "https://www.suse.com/security/cve/CVE-2016-10026"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1016606 for CVE-2016-10026",
          "url": "https://bugzilla.suse.com/1016606"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-10026"
    },
    {
      "cve": "CVE-2016-1238",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1238"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1238",
          "url": "https://www.suse.com/security/cve/CVE-2016-1238"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1108749 for CVE-2016-1238",
          "url": "https://bugzilla.suse.com/1108749"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123389 for CVE-2016-1238",
          "url": "https://bugzilla.suse.com/1123389"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 987887 for CVE-2016-1238",
          "url": "https://bugzilla.suse.com/987887"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988311 for CVE-2016-1238",
          "url": "https://bugzilla.suse.com/988311"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1238"
    },
    {
      "cve": "CVE-2016-3714",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-3714"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka \"ImageTragick.\"",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-3714",
          "url": "https://www.suse.com/security/cve/CVE-2016-3714"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1000484 for CVE-2016-3714",
          "url": "https://bugzilla.suse.com/1000484"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1057163 for CVE-2016-3714",
          "url": "https://bugzilla.suse.com/1057163"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105592 for CVE-2016-3714",
          "url": "https://bugzilla.suse.com/1105592"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 978061 for CVE-2016-3714",
          "url": "https://bugzilla.suse.com/978061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 980401 for CVE-2016-3714",
          "url": "https://bugzilla.suse.com/980401"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 982178 for CVE-2016-3714",
          "url": "https://bugzilla.suse.com/982178"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-3714"
    },
    {
      "cve": "CVE-2016-4561",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-4561"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-4561",
          "url": "https://www.suse.com/security/cve/CVE-2016-4561"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-4561"
    },
    {
      "cve": "CVE-2016-9645",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9645"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9645",
          "url": "https://www.suse.com/security/cve/CVE-2016-9645"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9645"
    },
    {
      "cve": "CVE-2016-9646",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9646"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-\u003efield method (similar to the CGI-\u003eparam API that led to Bugzilla\u0027s CVE-2014-1572), which can be abused to lead to commit metadata forgery.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9646",
          "url": "https://www.suse.com/security/cve/CVE-2016-9646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9646"
    },
    {
      "cve": "CVE-2017-0356",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-0356"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin\u0027s use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-0356",
          "url": "https://www.suse.com/security/cve/CVE-2017-0356"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-0356"
    },
    {
      "cve": "CVE-2019-9187",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9187"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
          "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9187",
          "url": "https://www.suse.com/security/cve/CVE-2019-9187"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1128085 for CVE-2019-9187",
          "url": "https://bugzilla.suse.com/1128085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-3.20200202.3-2.7.x86_64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.aarch64",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.ppc64le",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.s390x",
            "openSUSE Tumbleweed:ikiwiki-w3m-3.20200202.3-2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9187"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.