CVE-2019-3693
Local privilege escalation from user wwwrun to root in the packaging of mailman
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Local privilege escalation from user wwwrun to root in the packaging of mailman
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.
- Record
CVE-2019-3693- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2019-13328
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.
- Record
EUVD-2019-13328- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjp9-97x3-23vj
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11,...
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.
- Record
GHSA-mjp9-97x3-23vj- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.
- Record
CVE-2019-3693- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0148-1 No score
Security update for mailman
This update for mailman fixes the following issues:
- CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. (boo#1154328)
- Record
openSUSE-SU-2020:0148-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0156-1 No score
Security update for mailman
This update for mailman fixes the following issues:
- CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. (boo#1154328)
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0156-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14230-1 No score
Security update for mailman
This update for mailman fixes the following issues:
- CVE-2019-3693: Fixed a local privilege escalation from wwwrun to root (bsc#1154328).
- Record
SUSE-SU-2019:14230-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:3076-1 No score
Security update for mailman
This update for mailman fixes the following issues:
- CVE-2019-3693: Fixed a local privilege escalation from wwwrun to root (bsc#1154328).
- Record
SUSE-SU-2019:3076-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mailmanSUSE:Linux Enterprise Point of Sale 11 SP3 |
before 2.1.15-9.6.15.1 | 2.1.15-9.6.15.1 |
mailmanSUSE:Linux Enterprise Server 11 SP4-LTSS |
before 2.1.15-9.6.15.1 | 2.1.15-9.6.15.1 |
mailmanSUSE:HPE Helion OpenStack 8 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:OpenStack Cloud 7 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:OpenStack Cloud 8 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:OpenStack Cloud Crowbar 8 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mailmanSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server 12 SP3-BCL |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server 12 SP4 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server 12 SP5 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanSUSE:Enterprise Storage 5 |
before 2.1.17-3.11.1 | 2.1.17-3.11.1 |
mailmanopenSUSE:Leap 15.1 |
before 2.1.29-lp151.3.3.1 | 2.1.29-lp151.3.3.1 |
mailmanSUSE:Package Hub 15 SP1 |
before 2.1.29-bp151.5.3.1 | 2.1.29-bp151.5.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3693 is a high vulnerability (CVSS 7.7) in Opensuse Leap 15.1, published November 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in mailman 2.1.15-9.6.15.1.
References
lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html
bugzilla.suse.com/show_bug.cgi?id=1154328
nvd.nist.gov/vuln/detail/CVE-2019-3693
github.com/advisories/GHSA-mjp9-97x3-23vj
suse.com/support/update/announcement/2019/suse-su-201914230-1
Show 5 moreShow less