CVE-2017-15638

medium

Published 2017-11-10 · Modified 2026-05-13

CVSS v3

6.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CVSS v2

6.4

VIR risk

6.5

Description

The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2; before 3.6.312.333-3.10.1 in SLE Desktop 12 SP3 and Server 12 SP3; before 3.6_SVNr208-2.18.3.1 in SLE Server 11 SP4; before 3.6.312-5.9.1 in openSUSE Leap 42.2; and before 3.6.312.333-7.1 in openSUSE Leap 42.3 might allow remote attackers to bypass intended access restrictions on the portmap service by leveraging a missing source net restriction for _rpc_ services.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-15638.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://lists.opensuse.org/opensuse-updates/2017-11/msg00014.html

OS impact

OS	Version	Status
sles		affected
suse	42.2	not-affected
suse	42.3	not-affected
suse	12	not-affected
suse	11	not-affected

Application impact

Vendor	Product	Versions	Fixed
suse	susefirewall2	`-`

References

Verify integrity in audit chain (admin only). AS-IS.