{"id":"CVE-2019-18898","aliases":["EUVD-2019-8579","GHSA-w5w4-523j-qm3v","SUSE-SU-2019:3349-1","openSUSE-SU-2020:0015-1","openSUSE-SU-2020:0744-1","openSUSE-SU-2024:11476-1"],"status":"published","title":"trousers: Local privilege escalation from tss to root","description":"UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00482,"percentile":0.41827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2019-12-19T15:13:16Z","modified":"2026-06-17T02:25:32Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"trousers","fixed_in":["0.3.14-6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"trousers","fixed_in":["0.3.14-lp151.4.3.1","0.3.14-lp151.4.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"trousers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.14-6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"trousers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.14-lp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"trousers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.14-lp151.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trousers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.15-1.7"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"factory"},{"vendor":"opensuse","product":"leap"},{"vendor":"suse","product":"suse linux enterprise server 15 sp1"},{"vendor":"suse","product":"trousers"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00066.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1157651","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18898"},{"url":"https://github.com/advisories/GHSA-w5w4-523j-qm3v"},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193349-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157651","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18898","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TJ5PMK7N3UJLMALKX6JOIZBEP7XJGLLH/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IPMUZXQ2EEXKKUWFYJCRFUYXSXOEJHC6/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24332","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18898","title":"trousers: Local privilege escalation from tss to root","description":"UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.","status":"published","published":"2020-01-23T14:05:14.446Z","modified":"2024-09-16T18:24:53.684Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8579","description":"UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.","status":"published","published":"2020-01-23T14:05:14Z","modified":"2024-09-16T18:24:53Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:55:32.504958Z"}],"ghsa":[{"id":"GHSA-w5w4-523j-qm3v","title":"UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux...","description":"UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.","status":"published","published":"2022-05-24T17:07:12Z","modified":"2023-01-30T05:06:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:47:33.281523Z"}],"nvd":[{"id":"CVE-2019-18898","description":"UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.","status":"published","published":"2020-01-23T14:15:12.327Z","modified":"2026-06-17T02:25:32.767Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"openSUSE-SU-2020:0015-1","title":"Security update for trousers","description":"This update for trousers fixes the following issues:\n\n- CVE-2019-18898: Fixed a local symlink attack where a rogue tss user\n  could have gain ownership of arbitrary files in the system during\n  installation/update of the trousers package (bsc#1157651).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-01-13T15:17:08Z","modified":"2026-02-04T03:14:05.111082Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0744-1","title":"Security update for trousers","description":"This update for trousers fixes the following issues:\n\n- CVE-2019-18898: Fixed a local symlink attack where a rogue tss user\n  could have gain ownership of arbitrary files in the system during\n  installation/update of the trousers package (bsc#1157651).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-05-29T18:16:41Z","modified":"2026-02-04T02:47:29.076935Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11476-1","title":"libtspi1-0.3.15-1.7 on GA media","description":"These are all security issues fixed in the libtspi1-0.3.15-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:34.724817Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:3349-1","title":"Security update for trousers","description":"This update for trousers fixes the following issues:\n\n- CVE-2019-18898: Fixed a local symlink attack where a rogue tss user\n  could have gain ownership of arbitrary files in the system during\n  installation/update of the trousers package (bsc#1157651).\n","status":"published","published":"2019-12-19T15:13:16Z","modified":"2026-02-04T04:35:40.084145Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}