Every CVE Search/ Get API key

CVE-2019-5164

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev...

7.8 HighFix available

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.77%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
CVE-2019-5164
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
EUVDEUVD-2019-14769 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
EUVD-2019-14769
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-rcm9-p88f-cmqm 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev...

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
GHSA-rcm9-p88f-cmqm
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
NVD 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
CVE-2019-5164
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-306
Updated
2026-11-02
OSV 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
CVE-2019-5164
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-5164 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
DEBIAN-CVE-2019-5164
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2019-5164 7.8

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Record
UBUNTU-CVE-2019-5164
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0006 No score

Updated shadowsocks-libev packages fix security vulnerabilities

Updated shadowsocks-libev packages fix security vulnerabilities:

Exploitable denial-of-service vulnerability exists in the UDPRelay functionality (CVE-2019-5163).

Code execution vulnerability in the ss-manager binary (CVE-2019-5164).

Record
MGASA-2020-0006
Updated
2026-11-02
OSVopenSUSE-SU-2019:2667-1 No score

Security update for shadowsocks-libev

This update for shadowsocks-libev fixes the following issues:

  • Update version to 3.3.3
    • Refine the handling of suspicious connections.
    • Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163)
    • Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164)
    • Refine the handling of fragment request.
    • Fix a high CPU bug introduced in 3.3.0. (#2449)
    • Enlarge the socket buffer size to 16KB.
    • Fix the empty list bug in ss-manager.
    • Fix the IPv6 address parser.
    • Fix a bug of port parser.
    • Fix a crash with MinGW.
    • Refine SIP003 plugin interface.
    • Remove connection timeout from all clients.
    • Fix the alignment bug again.
    • Fix a bug on 32-bit arch.
    • Add TCP fast open support to ss-tunnel by @PantherJohn.
Record
openSUSE-SU-2019:2667-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0142-1 No score

Security update for shadowsocks-libev

This update for shadowsocks-libev fixes the following issues:

  • Update version to 3.3.3
    • Refine the handling of suspicious connections.
    • Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163)
    • Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164)
    • Refine the handling of fragment request.
    • Fix a high CPU bug introduced in 3.3.0. (#2449)
    • Enlarge the socket buffer size to 16KB.
    • Fix the empty list bug in ss-manager.
    • Fix the IPv6 address parser.
    • Fix a bug of port parser.
    • Fix a crash with MinGW.
    • Refine SIP003 plugin interface.
    • Remove connection timeout from all clients.
    • Fix the alignment bug again.
    • Fix a bug on 32-bit arch.
    • Add TCP fast open support to ss-tunnel by @PantherJohn.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2020:0142-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11379-1 No score

libshadowsocks-libev2-3.3.5-1.9 on GA media

These are all security issues fixed in the libshadowsocks-libev2-3.3.5-1.9 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11379-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shadowsocks-libev
Debian:12
 before 3.3.3+ds-2
3.3.3+ds-2
shadowsocks-libev
Debian:13
 before 3.3.3+ds-2
3.3.3+ds-2
shadowsocks-libev
Mageia:7
 before 3.3.3-1.mga7
3.3.3-1.mga7
shadowsocks-libev
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.8+ds-23.1.0+ds-33.1.0+ds-43.1.0+ds-53.1.1+ds-1
Show 4 moreShow less
3.1.1+ds-23.1.1+ds-33.1.3+ds-1ubuntu13.1.3+ds-1ubuntu2
 None known
shadowsocks-libev
openSUSE:Leap 15.1
 before 3.3.3-lp151.2.3.1
3.3.3-lp151.2.3.1
shadowsocks-libev
SUSE:Package Hub 15 SP1
 before 3.3.3-bp151.5.3.1
3.3.3-bp151.5.3.1
shadowsocks-libev
openSUSE:Tumbleweed
 before 3.3.5-1.9
3.3.5-1.9

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-5164 is a high vulnerability (CVSS 7.8) in Shadowsocks Shadowsocks-libev, published December 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in shadowsocks-libev 3.3.3+ds-2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open