CVE-2019-3690
Summary
| CVE | CVE-2019-3690 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-12-05 16:15:00 UTC |
| Updated | 2020-11-20 16:15:00 UTC |
| Description | The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges. |
Risk And Classification
Problem Types: CWE-59
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [security-announce] openSUSE-SU-2019:2672-1: moderate: Security update f | SUSE | lists.opensuse.org | Third Party Advisory |
| Bug 1150734 – VUL-0: CVE-2019-3690: permissions: chkstat follows untrusted symbolic links | CONFIRM | bugzilla.suse.com | Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Malte Kraus of SUSE
Legacy QID Mappings
- 750751 SUSE Enterprise Linux Security Update for permissions (SUSE-SU-2021:2280-1)