CVE-2019-19725
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
CVE-2019-19725 is a critical vulnerability (CVSS 9.8) in Sysstat Project Sysstat, published December 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in sysstat 12.2.0-2.
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
CVE-2019-19725- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE List No score
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
CVE-2019-19725- Updated
- 2026-11-02
EUVDEUVD-2019-9327 No score
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
EUVD-2019-9327- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-25j9-j567-gc6p
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
GHSA-25j9-j567-gc6p- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSV
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
CVE-2019-19725- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-19725
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
DEBIAN-CVE-2019-19725- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2019-19725
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Record
UBUNTU-CVE-2019-19725- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0064 No score
Updated sysstat packages fix security vulnerability
Updated sysstat package fixes security vulnerability:
Double free in check_file_actlst in sa_common.c (CVE-2019-19725).
- Record
MGASA-2020-0064- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0736-1 No score
Security update for sysstat
This update for sysstat fixes the following issues:
- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0736-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11419-1 No score
sysstat-12.4.3-3.2 on GA media
These are all security issues fixed in the sysstat-12.4.3-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11419-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0026-1 No score
Security update for sysstat
This update for sysstat fixes the following issues:
Security issue fixed:
- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).
Bug fixes:
- Enable log information of starting/stoping services. (bsc#1144923, jsc#SLE-5958)
- Record
SUSE-SU-2020:0026-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0026-2 No score
Security update for sysstat
This update for sysstat fixes the following issues:
Security issue fixed:
- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).
Bug fixes:
- Enable log information of starting/stoping services. (bsc#1144923, jsc#SLE-5958)
- Record
SUSE-SU-2020:0026-2- Updated
- 2026-11-02
OSVSUSE-SU-2020:1419-1 No score
Security update for sysstat
This update for sysstat fixes the following issues:
- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).
- Record
SUSE-SU-2020:1419-1- Updated
- 2026-11-02
OSVUSN-4242-1 No score
sysstat vulnerabilities
It was discovered that Sysstat incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-16167)
It was discovered that Sysstat incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-19725)
- Record
USN-4242-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sysstatDebian:12 |
before 12.2.0-2 | 12.2.0-2 |
sysstatDebian:13 |
before 12.2.0-2 | 12.2.0-2 |
sysstatDebian:14 |
before 12.2.0-2 | 12.2.0-2 |
sysstatDebian:10 |
before 12.0.3-2+deb10u1, plus listed versions 12.0.3-2 |
12.0.3-2+deb10u1 |
sysstatMageia:7 |
before 12.2.1-1.mga7 | 12.2.1-1.mga7 |
sysstatSUSE:Linux Enterprise Desktop 12 SP4 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server 12 SP4 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server 12 SP5 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sysstatSUSE:HPE Helion OpenStack 8 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:OpenStack Cloud 8 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:OpenStack Cloud 9 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:OpenStack Cloud Crowbar 8 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:OpenStack Cloud Crowbar 9 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server 12 SP2-BCL |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Server 12 SP3-BCL |
before 12.0.2-10.36.1 | 12.0.2-10.36.1 |
sysstatSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 12.0.2-3.21.18 | 12.0.2-3.21.18 |
sysstatSUSE:Linux Enterprise Module for Server Applications 15 SP1 |
before 12.0.2-3.21.18 | 12.0.2-3.21.18 |
sysstatUbuntu:16.04:LTS |
before 11.2.0-1ubuntu0.3, plus listed versions 11.1.5-111.1.7-111.1.8-111.2.0-111.2.0-1ubuntu0.111.2.0-1ubuntu0.2 |
11.2.0-1ubuntu0.3 |
sysstatUbuntu:18.04:LTS |
before 11.6.1-1ubuntu0.1, plus listed versions 11.5.7-1ubuntu111.6.0-1ubuntu111.6.0-1ubuntu211.6.1-1 |
11.6.1-1ubuntu0.1 |
sysstatopenSUSE:Leap 15.1 |
before 12.0.2-lp151.3.15.1 | 12.0.2-lp151.3.15.1 |
sysstatopenSUSE:Tumbleweed |
before 12.4.3-3.2 | 12.4.3-3.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/sysstat/sysstat/issues/242
usn.ubuntu.com/4242-1
security.gentoo.org/glsa/202007-22
lists.debian.org/debian-lts-announce/2022/11/msg00014.html
nvd.nist.gov/vuln/detail/CVE-2019-19725
Show 21 moreShow less
security-tracker.debian.org/tracker/CVE-2019-19725
advisories.mageia.org/MGASA-2020-0064.html
bugs.mageia.org/show_bug.cgi?id=26067
lists.suse.com/pipermail/sle-security-updates/2020-January/006302.html
suse.com/support/update/announcement/2020/suse-su-20200026-1
bugzilla.suse.com/1144923
ubuntu.com/security/CVE-2019-19725
cve.org/CVERecord?id=CVE-2019-19725
lists.opensuse.org/archives/list/[email protected]/thread/J3UMLHRLU5KIDWCL7FK5UTVMPY6ZZKKS