{"id":"CVE-2018-19636","aliases":["EUVD-2018-11321","GHSA-f264-4fj2-rjpf","SUSE-SU-2019:1122-1","SUSE-SU-2019:13976-1"],"status":"published","title":"Local root exploit via inclusion of attacker controlled shell script","description":"Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00318,"percentile":0.2486,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-306"],"published":"2019-03-05T16:00:00Z","modified":"2026-06-17T01:49:38Z","affected":[{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"hostinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-19.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0-95.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-122.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-122.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"supportutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-122.9.1"}]}],"bundled":4}],"products":[{"vendor":"opensuse","product":"supportutils"},{"vendor":"suse","product":"supportutils"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1117751","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19636"},{"url":"https://github.com/advisories/GHSA-f264-4fj2-rjpf"},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191122-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054979","tags":["report"]},{"url":"https://bugzilla.suse.com/1099498","tags":["report"]},{"url":"https://bugzilla.suse.com/1115245","tags":["report"]},{"url":"https://bugzilla.suse.com/1117751","tags":["report"]},{"url":"https://bugzilla.suse.com/1117776","tags":["report"]},{"url":"https://bugzilla.suse.com/1118460","tags":["report"]},{"url":"https://bugzilla.suse.com/1118462","tags":["report"]},{"url":"https://bugzilla.suse.com/1118463","tags":["report"]},{"url":"https://bugzilla.suse.com/1125623","tags":["report"]},{"url":"https://bugzilla.suse.com/1125666","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19640","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913976-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-19636","title":"Local root exploit via inclusion of attacker controlled shell script","description":"Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges","status":"published","published":"2019-03-05T16:00:00Z","modified":"2024-09-17T04:03:59.444Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2018-11321","description":"Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges","status":"published","published":"2019-03-05T16:00:00Z","modified":"2024-09-17T04:03:59Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:26.623918Z"}],"ghsa":[{"id":"GHSA-f264-4fj2-rjpf","title":"Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file...","description":"Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges","status":"published","published":"2022-05-14T01:05:26Z","modified":"2023-02-02T05:02:56Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:51:32.364862Z"}],"nvd":[{"id":"CVE-2018-19636","description":"Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges","status":"published","published":"2019-03-05T16:29:00.293Z","modified":"2026-06-17T01:49:38.28Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-306","CWE-20"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"SUSE-SU-2019:1122-1","title":"Security update for hostinfo, supportutils","description":"This update for hostinfo, supportutils fixes the following issues:\n\t  \nSecurity issues fixed for supportutils:\n\n- CVE-2018-19640: Fixed an issue where  users could kill arbitrary processes (bsc#1118463).\n- CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460).\n- CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462).\n- CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776).\n- CVE-2018-19636: Fixed a local root exploit via inclusion of attacker controlled shell script (bsc#1117751).\n\nOther issues fixed for supportutils:\n\n- Fixed invalid exit code commands (bsc#1125666)\n- SUSE separation in supportconfig (bsc#1125623)\n- Clarified supportconfig(8) -x option (bsc#1115245)\n- supportconfig: 3.0.127\n- btrfs filesystem usage\n- List products.d\n- Dump lsof errors\n- Added ha commands for corosync\n- Dumped find errors in ib_info\n\nIssues fixed in hostinfo:\n- Removed extra kernel install dates (bsc#1099498)\n- Resolved network bond issue (bsc#1054979)\n","status":"published","published":"2019-04-30T16:04:21Z","modified":"2026-02-04T02:26:12.378116Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13976-1","title":"Security update for supportutils","description":"This update for supportutils fixes the following issues:\n\nSecurity vulnerabilities fixed:\n\n- CVE-2018-19636: Local root exploit via inclusion of attacker controlled shell script (bsc#1117751)\n- CVE-2018-19640: Users can kill arbitrary processes (bsc#1118463)\n- CVE-2018-19638: User can overwrite arbitrary log files in support tar (bsc#1118460)\n- CVE-2018-19639: Code execution if run with -v (bsc#1118462)\n","status":"published","published":"2019-03-12T17:40:58Z","modified":"2026-02-04T02:45:14.474395Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}