CVE-2018-10916 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-10916 Interim 1 43 2025-11-05T03:30:34Z current 2021-05-30T14:13:09Z 2025-11-05T03:30:34Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-10916 It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/update/announcement/2019/suse-su-20190642-1.html E-Mail link for SUSE-SU-2019:0642-1 https://www.suse.com/support/update/announcement/2019/suse-su-20190643-1.html E-Mail link for SUSE-SU-2019:0643-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F5FJ7FPTQKOW7OZUV3B6327DJFZ5BZUT/#F5FJ7FPTQKOW7OZUV3B6327DJFZ5BZUT E-Mail link for openSUSE-SU-2019:1059-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZZFM7KI5WN2TTJGW46TEIEVSEIISQ7N3/#ZZFM7KI5WN2TTJGW46TEIEVSEIISQ7N3 E-Mail link for openSUSE-SU-2019:1110-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings HPE Helion OpenStack 8 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Liberty Linux 7 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP3-TERADATA SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Business Critical Linux 15 SP1 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Manager Proxy 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Manager Retail Branch Server 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Manager Server 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openSUSE Leap 15.0 openSUSE Tumbleweed lftp lftp-4.4.8-12.el7 lftp-4.7.4-3.6.1 lftp-4.8.3-4.3.1 lftp-4.8.3-lp150.3.3.1 lftp-4.8.4-3.9 lftp-4.8.4-5.3.1 lftp-4.9.2-1.7 lftp-4.9.2-150400.1.8 lftp-4.9.2-150600.7.3 lftp-4.9.2-160000.2.2 lftp-scripts-4.4.8-12.el7 lftp-4.4.8-12.el7 as a component of SUSE Liberty Linux 7 lftp-scripts-4.4.8-12.el7 as a component of SUSE Liberty Linux 7 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 lftp-4.8.3-4.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 lftp-4.8.4-3.9 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 lftp-4.8.4-3.9 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 lftp-4.8.4-5.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 lftp-4.9.2-150400.1.8 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 lftp-4.9.2-150400.1.8 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 lftp-4.9.2-150600.7.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 lftp-4.9.2-150600.7.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP3 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP3-TERADATA lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP4 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 lftp-4.9.2-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 lftp-4.7.4-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 lftp-4.8.3-lp150.3.3.1 as a component of openSUSE Leap 15.0 lftp-4.9.2-1.7 as a component of openSUSE Tumbleweed lftp as a component of HPE Helion OpenStack 8 lftp as a component of SUSE CaaS Platform 4.0 lftp as a component of SUSE Enterprise Storage 6 lftp as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 lftp as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS lftp as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 lftp as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS lftp as a component of SUSE Linux Enterprise Server 12 SP4-LTSS lftp as a component of SUSE Linux Enterprise Server 12 SP5 lftp as a component of SUSE Linux Enterprise Server 15 SP1-LTSS lftp as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP1 lftp as a component of SUSE Linux Enterprise Server Teradata 12 SP3 lftp as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 lftp as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 lftp as a component of SUSE Manager Proxy 4.0 lftp as a component of SUSE Manager Retail Branch Server 4.0 lftp as a component of SUSE Manager Server 4.0 lftp as a component of SUSE OpenStack Cloud 8 lftp as a component of SUSE OpenStack Cloud 9 lftp as a component of SUSE OpenStack Cloud Crowbar 8 lftp as a component of SUSE OpenStack Cloud Crowbar 9 It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system. CVE-2018-10916 SUSE Liberty Linux 7:lftp-4.4.8-12.el7 SUSE Liberty Linux 7:lftp-scripts-4.4.8-12.el7 SUSE Linux Enterprise Desktop 12 SP3:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Desktop 12 SP4:lftp-4.7.4-3.6.1 SUSE Linux Enterprise High Performance Computing 12 SP5:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Module for Basesystem 15:lftp-4.8.3-4.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:lftp-4.8.4-3.9 SUSE Linux Enterprise Module for Basesystem 15 SP2:lftp-4.8.4-3.9 SUSE Linux Enterprise Module for Basesystem 15 SP3:lftp-4.8.4-5.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:lftp-4.9.2-150400.1.8 SUSE Linux Enterprise Module for Basesystem 15 SP5:lftp-4.9.2-150400.1.8 SUSE Linux Enterprise Module for Basesystem 15 SP6:lftp-4.9.2-150600.7.3 SUSE Linux Enterprise Module for Basesystem 15 SP7:lftp-4.9.2-150600.7.3 SUSE Linux Enterprise Server 12 SP3:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Server 12 SP3-TERADATA:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Server 12 SP4:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Server 12 SP5:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Server 16.0:lftp-4.9.2-160000.2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:lftp-4.7.4-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:lftp-4.7.4-3.6.1 openSUSE Leap 15.0:lftp-4.8.3-lp150.3.3.1 openSUSE Tumbleweed:lftp-4.9.2-1.7 SUSE CaaS Platform 4.0:lftp SUSE Enterprise Storage 6:lftp SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:lftp SUSE Linux Enterprise Module for Basesystem 15 SP2:lftp SUSE Linux Enterprise Server 15 SP1-LTSS:lftp SUSE Linux Enterprise Server Business Critical Linux 15 SP1:lftp SUSE Linux Enterprise Server for SAP Applications 15 SP1:lftp SUSE Manager Proxy 4.0:lftp SUSE Manager Retail Branch Server 4.0:lftp SUSE Manager Server 4.0:lftp moderate 7.8 AV:N/AC:M/Au:N/C:N/I:P/A:C 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N