CVE-2019-3699
published 2020-01-24CVE-2019-3699: UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.41%
33.4th percentile
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opensuse | factory | privoxy – 3.0.28-2.1 | — |
| opensuse | leap_15.1 | privoxy – 3.0.28-lp151.1.1 | — |
| privoxy | privoxy | < 3.0.28-lp151.1.1 | 3.0.28-lp151.1.1 |
| privoxy | privoxy | < 3.0.28-2.1 | 3.0.28-2.1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
privoxy: local privilege escalation from privoxy to root
vendor_redhat·2020-01-24·CVSS 7.7
CVE-2019-3699 [HIGH] CWE-59 privoxy: local privilege escalation from privoxy to root
privoxy: local privilege escalation from privoxy to root
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.
Package: privoxy (Red Hat Enterprise Linux 5) - Not affected
GHSA
GHSA-j9ww-72pm-37h3: UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15
ghsa_unreviewed·2022-05-24
CVE-2019-3699 [HIGH] CWE-59 GHSA-j9ww-72pm-37h3: UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.
No detection rules found.
No public exploits indexed.
2020-01-24
Published