Lucene search

SuseCVE-2019-3699

HistoryJan 24, 2020 - 1:15 p.m.

CVE-2019-3699

2020-01-2413:15:11

CWE-59

suse

web.nvd.nist.gov

cve-2019-3699

privoxy

opensuse leap 15.1

opensuse factory

symlink vulnerability

nvd

unix

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.

Affected configurations

Nvd

Node

privoxyprivoxyRange<3.0.28-lp151.1.1

AND

opensuseleapMatch15.1

Node

privoxyprivoxyRange<3.0.28-2.1

AND

opensusefactoryMatch-

VendorProductVersionCPE
privoxyprivoxy*cpe:2.3:a:privoxy:privoxy:*:*:*:*:*:*:*:*
opensuseleap15.1cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
opensusefactory-cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
privoxy	privoxy	*	cpe:2.3:a:privoxy:privoxy::::::::
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*
opensuse	factory	-	cpe:2.3:a:opensuse:factory:-:::::::*

CNA Affected

[
  {
    "product": "Leap 15.1",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThanOrEqual": "3.0.28-lp151.1.1",
        "status": "affected",
        "version": "privoxy",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Factory",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThanOrEqual": "3.0.28-2.1",
        "status": "affected",
        "version": "privoxy",
        "versionType": "custom"
      }
    ]
  }
]

References

bugzilla.suse.com/show_bug.cgi?id=1157449

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-3699