openSUSE Leap 15.2
openSUSE Leap 15.2
The SUSE openSUSE Leap 15.2 reached end of service life on Jan 4, 2022 — SUSE no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your openSUSE Leap 15.2 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- opensuse
- release
- 15.2
- product Label
- openSUSE
- release Label
- Leap 15.2
- codename
- lts
- latest Version
- release Date
- 2020-07-02
- maintained
- source Url
- https://endoflife.date/opensuse
Lifecycle Dates
- End of Service Life
- Jan 4, 2022
- Last OEM Support
- Jan 4, 2022
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for openSUSE Leap 15.2 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for openSUSE Leap 15.2?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for openSUSE Leap 15.2 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
openSUSE Leap 15.2 Support: Frequently Asked Questions
Is the SUSE openSUSE Leap 15.2 still supported?
SUSE ended support for the openSUSE Leap 15.2 on Jan 4, 2022 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the SUSE openSUSE Leap 15.2 end of service life (EOSL) date?
SUSE lists the end of service life for the openSUSE Leap 15.2 as Jan 4, 2022.
Can I keep using the openSUSE Leap 15.2 after its EOSL date?
Yes. EOSL means SUSE stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the openSUSE Leap 15.2 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting openSUSE Leap 15.2
375 published CVEs affect the SUSE openSUSE Leap 15.2, including 181 rated critical or high severity. SUSE no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-15683 | CRITICAL | 9.8 | Oct 22, 2020 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. |
| CVE-2020-26935 | CRITICAL | 9.8 | Oct 10, 2020 | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query. |
| CVE-2020-11800 | CRITICAL | 9.8 | Oct 7, 2020 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. |
| CVE-2020-26154 | CRITICAL | 9.8 | Sep 30, 2020 | url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header. |
| CVE-2020-17368 | CRITICAL | 9.8 | Aug 11, 2020 | Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection. |
| CVE-2020-11984 | CRITICAL | 9.8 | Aug 7, 2020 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE |
| CVE-2020-17353 | CRITICAL | 9.8 | Aug 5, 2020 | scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code. |
| CVE-2020-15900 | CRITICAL | 9.8 | Jul 28, 2020 | A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b. |
| CVE-2020-15917 | CRITICAL | 9.8 | Jul 23, 2020 | common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. |
| CVE-2017-18922 | CRITICAL | 9.8 | Jun 30, 2020 | It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. |
| CVE-2020-14983 | CRITICAL | 9.8 | Jun 22, 2020 | The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack. |
| CVE-2020-8165 | CRITICAL | 9.8 | Jun 19, 2020 | A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE. |
| CVE-2020-6831 | CRITICAL | 9.8 | May 26, 2020 | A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. |
| CVE-2020-12823 | CRITICAL | 9.8 | May 12, 2020 | OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c. |
| CVE-2020-12641 | CRITICAL | 9.8 | May 4, 2020 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. |
| CVE-2020-12640 | CRITICAL | 9.8 | May 4, 2020 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. |
| CVE-2020-8432 | CRITICAL | 9.8 | Jan 29, 2020 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis. |
| CVE-2019-9215 | CRITICAL | 9.8 | Feb 28, 2019 | In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. |
| CVE-2018-19873 | CRITICAL | 9.8 | Dec 26, 2018 | An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. |
| CVE-2020-16011 | CRITICAL | 9.6 | Nov 3, 2020 | Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
Showing the 20 most severe of 375 known CVEs.
Get Third Party Support