{"id":"CVE-2019-19725","aliases":["DEBIAN-CVE-2019-19725","DLA-3188-1","EUVD-2019-9327","GHSA-25j9-j567-gc6p","MGASA-2020-0064","SUSE-SU-2020:0026-1","SUSE-SU-2020:0026-2","SUSE-SU-2020:1419-1","UBUNTU-CVE-2019-19725","USN-4242-1","openSUSE-SU-2020:0736-1","openSUSE-SU-2024:11419-1"],"status":"published","title":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02582,"percentile":0.85428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2019-12-11T00:00:00Z","modified":"2026-10-24T10:47:42Z","fixes":[{"ecosystem":"Debian:12","package":"sysstat","fixed_in":["12.2.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sysstat","fixed_in":["12.2.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sysstat","fixed_in":["12.2.0-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"sysstat","fixed_in":["12.2.1-1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"sysstat","fixed_in":["12.0.2-10.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"sysstat","fixed_in":["12.0.2-3.21.18"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"sysstat","fixed_in":["12.0.2-3.21.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sysstat","fixed_in":["11.2.0-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sysstat","fixed_in":["11.6.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"sysstat","fixed_in":["12.0.2-lp151.3.15.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2+deb10u1"}]}],"versions":["12.0.3-2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.1-1.mga7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-3.21.18"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-3.21.18"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.0-1ubuntu0.3"}]}],"versions":["11.1.5-1","11.1.7-1","11.1.8-1","11.2.0-1","11.2.0-1ubuntu0.1","11.2.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.1-1ubuntu0.1"}]}],"versions":["11.5.7-1ubuntu1","11.6.0-1ubuntu1","11.6.0-1ubuntu2","11.6.1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.0-1ubuntu0.3"}]}],"versions":["11.1.5-1","11.1.7-1","11.1.8-1","11.2.0-1","11.2.0-1ubuntu0.1","11.2.0-1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.1-1ubuntu0.1"}]}],"versions":["11.5.7-1ubuntu1","11.6.0-1ubuntu1","11.6.0-1ubuntu2","11.6.1-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-lp151.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.3-3.2"}]}],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"sysstat_project","product":"sysstat"}],"references":[{"url":"https://github.com/sysstat/sysstat/issues/242","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/4242-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202007-22","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19725"},{"url":"https://github.com/advisories/GHSA-25j9-j567-gc6p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19725","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0064.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26067","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2020-January/006302.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200026-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144923","tags":["report"]},{"url":"https://bugzilla.suse.com/1159104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19725","tags":["web"]},{"url":"https://bugzilla.suse.com/SLE-5958","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200026-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201419-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19725","tags":["report"]},{"url":"https://github.com/sysstat/sysstat/commit/a5c8abd4a481ee6e27a3acf00e6d9b0f023e20ed","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4242-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-16167","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J3UMLHRLU5KIDWCL7FK5UTVMPY6ZZKKS/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16167","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-19725","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2019-12-11T00:00:00Z","modified":"2024-08-05T02:25:12.364Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-9327","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2019-12-11T00:00:00Z","modified":"2024-08-05T02:25:12Z","updated_at":"2026-11-03T02:40:24.313121Z"}],"ghsa":[{"id":"GHSA-25j9-j567-gc6p","title":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2022-05-24T17:03:17Z","modified":"2023-02-02T05:08:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:52:40.925332Z"}],"nvd":[{"id":"CVE-2019-19725","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2019-12-11T18:16:20.053Z","modified":"2026-06-17T02:27:08.74Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"CVE-2019-19725","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2019-12-11T18:16:20.053Z","modified":"2026-10-24T10:47:42.710411984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19725","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2019-12-11T18:16:20.053Z","modified":"2026-09-21T07:01:56.66006248Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-19725","description":"sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.","status":"published","published":"2019-12-11T18:16:00Z","modified":"2026-02-04T02:21:13.02045Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-3188-1","title":"sysstat - security update","status":"published","published":"2022-11-14T00:00:00Z","modified":"2026-03-09T01:23:22.453928Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2020-0064","title":"Updated sysstat packages fix security vulnerability","description":"Updated sysstat package fixes security vulnerability:\n\nDouble free in check_file_actlst in sa_common.c (CVE-2019-19725).\n","status":"published","published":"2020-01-28T11:32:54Z","modified":"2026-04-16T04:42:34.699033357Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0736-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\n- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-05-29T14:16:09Z","modified":"2025-05-07T18:10:57.329144Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11419-1","title":"sysstat-12.4.3-3.2 on GA media","description":"These are all security issues fixed in the sysstat-12.4.3-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:53.917004Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:0026-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issue fixed:                                                                                                                                                               \n                                                                                                                                                                                   \n- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).                                                                                    \n\nBug fixes:\n\n- Enable log information of starting/stoping services. (bsc#1144923, jsc#SLE-5958)\n","status":"published","published":"2020-01-07T12:54:07Z","modified":"2026-02-04T03:40:45.464476Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0026-2","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issue fixed:                                                                                                                                                               \n                                                                                                                                                                                   \n- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).                                                                                    \n\nBug fixes:\n\n- Enable log information of starting/stoping services. (bsc#1144923, jsc#SLE-5958)\n","status":"published","published":"2022-07-04T15:04:08Z","modified":"2026-02-04T02:51:55.056649Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:1419-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\n- CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104).\n","status":"published","published":"2020-05-26T10:23:37Z","modified":"2026-02-04T03:46:16.199984Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4242-1","title":"sysstat vulnerabilities","description":"It was discovered that Sysstat incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a crash or execute\narbitrary code. This issue only affected Ubuntu 19.04 and Ubuntu 19.10.\n(CVE-2019-16167)\n\nIt was discovered that Sysstat incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2019-19725)\n","status":"published","published":"2020-01-20T12:07:53Z","modified":"2026-02-10T04:41:45Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}