Описание
Security update for NetworkManager
This update for NetworkManager fixes the following issues:
- CVE-2025-9615: avoid non-admin user using other users' certificate (bsc#1257359).
- CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
Список пакетов
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:4181-1
- E-Mail link for SUSE-SU-2026:4181-1
- SUSE Security Ratings
- SUSE Bug 1257359
- SUSE Bug 1267696
- SUSE CVE CVE-2025-9615 page
- SUSE CVE CVE-2026-10805 page
Описание
A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.
Затронутые продукты
Ссылки
- CVE-2025-9615
- SUSE Bug 1257359
- SUSE Bug 1276764
Описание
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
Затронутые продукты
Ссылки
- CVE-2026-10805
- SUSE Bug 1267696