{"id":"CVE-2019-18932","aliases":["DEBIAN-CVE-2019-18932","EUVD-2019-8605","GHSA-jcx8-j739-fp6q","UBUNTU-CVE-2019-18932","openSUSE-SU-2020:0117-1","openSUSE-SU-2020:0140-1"],"status":"published","title":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation....","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0025,"percentile":0.16438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-362","CWE-59"],"published":"2020-01-21T17:52:21Z","modified":"2026-09-21T07:03:12Z","fixes":[{"ecosystem":"Debian:12","package":"sarg","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sarg","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sarg","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"sarg","fixed_in":["2.3.10-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"sarg","fixed_in":["2.3.10-bp151.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10-1ubuntu1","2.3.10-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10-2","2.3.11-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.11-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"sarg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-bp151.4.3.1"}]}]}],"products":[{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"squid_analysis_report_generator_project","product":"squid_analysis_report_generator"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1150554","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://sourceforge.net/projects/sarg/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/20/6","tags":["mailing-list","x_refsource_MLIST","x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://seclists.org/oss-sec/2020/q1/23","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/27/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202007-32","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18932"},{"url":"https://sourceforge.net/projects/sarg"},{"url":"https://github.com/advisories/GHSA-jcx8-j739-fp6q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18932","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18932","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/01/20/6","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18932","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6FENLJBPGJYRWH4TRRWY3B45BZMEUJD2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1156643","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18932","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LH3KEKGAWAXLOMWQWUFGTQDXONO4SZRS/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-18932","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2020-01-21T17:52:21Z","modified":"2024-08-05T02:02:39.854Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8605","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2020-01-21T17:52:21Z","modified":"2024-08-05T02:02:39Z","updated_at":"2026-11-03T02:40:26.778341Z"}],"ghsa":[{"id":"GHSA-jcx8-j739-fp6q","title":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation....","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2022-05-24T17:07:01Z","modified":"2024-04-04T02:46:43Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-362"],"updated_at":"2026-11-02T14:56:11.559223Z"}],"nvd":[{"id":"CVE-2019-18932","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2020-01-21T18:15:12.89Z","modified":"2026-06-17T02:25:35.96Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-59","CWE-362"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"CVE-2019-18932","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2020-01-21T18:15:12.89Z","modified":"2026-03-15T22:31:07.982374Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18932","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2020-01-21T18:15:12.89Z","modified":"2026-09-21T07:03:12.548872543Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-18932","description":"log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.","status":"published","published":"2020-01-21T18:15:00Z","modified":"2025-10-24T04:47:58Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"openSUSE-SU-2020:0117-1","title":"Security update for sarg","description":"This update for sarg fixes the following issues:\n\n- CVE-2019-18932: Fixed insecure usage of /tmp/sarg which potentially allowed privilege escalation or denial of service (boo#1156643).\n","status":"published","published":"2020-01-28T09:13:35Z","modified":"2026-02-04T03:42:00.38267Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0140-1","title":"Security update for sarg","description":"This update for sarg fixes the following issues:\n\n- CVE-2019-18932: Fixed insecure usage of /tmp/sarg which potentially allowed privilege escalation or denial of service (boo#1156643).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-01-29T16:42:04Z","modified":"2025-05-07T18:10:56.270153Z","updated_at":"2026-11-02T16:58:31.152112Z"}]}}