PT-2019-6218 · Opensuse+1 · Opensuse Leap+2

Malte Kraus

·

Published

2019-12-05

·

Updated

2024-06-15

·

CVE-2019-3690

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions permissions package versions prior to commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 openSUSE Leap (affected versions not specified)
Description The issue is related to the chkstat tool in the permissions package, which followed symlinks, allowing local attackers with control over a traversed path to escalate privileges. This is due to errors in handling symbolic links.
Recommendations For versions prior to commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230, consider applying the fix committed in a9e1d26cd49ef9ee0c2060c859321128a6dd4230 and review additional hardenings. For openSUSE Leap, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2022-03981
CVE-2019-3690
OPENSUSE-SU-2019:2672-1
OPENSUSE-SU-2019_2672-1
OPENSUSE-SU-2024:11165-1
SUSE-SU-2019:14237-1
SUSE-SU-2019:3180-1
SUSE-SU-2019:3182-1
SUSE-SU-2019:3183-1
SUSE-SU-2019_14237-1
SUSE-SU-2020:1163-1
SUSE-SU-2021:2280-1

Affected Products

Suse
Opensuse Leap
Permissions