CVE-2019-18898
trousers: Local privilege escalation from tss to root
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
trousers: Local privilege escalation from tss to root
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
- Record
CVE-2019-18898- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2019-8579
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
- Record
EUVD-2019-8579- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w5w4-523j-qm3v
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux...
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
- Record
GHSA-w5w4-523j-qm3v- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
- Record
CVE-2019-18898- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0015-1 No score
Security update for trousers
This update for trousers fixes the following issues:
- CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package (bsc#1157651).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0015-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0744-1 No score
Security update for trousers
This update for trousers fixes the following issues:
- CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package (bsc#1157651).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0744-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11476-1 No score
libtspi1-0.3.15-1.7 on GA media
These are all security issues fixed in the libtspi1-0.3.15-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11476-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:3349-1 No score
Security update for trousers
This update for trousers fixes the following issues:
- CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package (bsc#1157651).
- Record
SUSE-SU-2019:3349-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trousersSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 0.3.14-6.3.1 | 0.3.14-6.3.1 |
trousersopenSUSE:Leap 15.1 |
before 0.3.14-lp151.4.3.1 | 0.3.14-lp151.4.3.1 |
trousersopenSUSE:Leap 15.1 |
before 0.3.14-lp151.4.6.1 | 0.3.14-lp151.4.6.1 |
trousersopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.3.15-1.7 | 0.3.15-1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18898 is a high vulnerability (CVSS 7.7) in Opensuse Factory, published December 19, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in trousers 0.3.14-6.3.1.