CVE-2016-1601: Suse YAST2

Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days.

yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.

Affected products

• Suse YAST2: any version

Published 2016-04-26. Last modified 2026-06-17.