{"id":"CVE-2019-3690","aliases":["EUVD-2019-13325","GHSA-jxhx-2gqw-c77x","SUSE-SU-2019:14237-1","SUSE-SU-2019:3180-1","SUSE-SU-2019:3182-1","SUSE-SU-2019:3183-1","SUSE-SU-2020:1163-1","SUSE-SU-2021:2280-1","openSUSE-SU-2019:2672-1","openSUSE-SU-2024:11165-1"],"status":"published","title":"chkstat follows untrusted symbolic links","description":"The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00423,"percentile":0.36889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2019-12-05T10:42:59Z","modified":"2026-06-17T02:35:23Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"permissions","fixed_in":["2013.1.7-0.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"permissions","fixed_in":["2013.1.7-0.6.5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.7-0.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.7-0.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.09.28.1626-17.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180125-3.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180125-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180125-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180125-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180125-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-6.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170707-6.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20181116-lp151.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1550_20210901.1550-29.2"}]}],"bundled":4}],"products":[{"vendor":"opensuse","product":"leap"},{"vendor":"suse","product":"permissions"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1150734","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3690"},{"url":"https://github.com/advisories/GHSA-jxhx-2gqw-c77x"},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914237-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1150734","tags":["report"]},{"url":"https://bugzilla.suse.com/1157198","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3690","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193180-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1093414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3688","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193182-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193183-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047247","tags":["report"]},{"url":"https://bugzilla.suse.com/1097665","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201163-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160594","tags":["report"]},{"url":"https://bugzilla.suse.com/1160764","tags":["report"]},{"url":"https://bugzilla.suse.com/1161779","tags":["report"]},{"url":"https://bugzilla.suse.com/1163922","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8013","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1050467","tags":["report"]},{"url":"https://bugzilla.suse.com/1123886","tags":["report"]},{"url":"https://bugzilla.suse.com/1155939","tags":["report"]},{"url":"https://bugzilla.suse.com/1171883","tags":["report"]},{"url":"https://bugzilla.suse.com/1182899","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RG7IYFDNSRBUQ54SPQV4SRC2ACYCQLTV/#RG7IYFDNSRBUQ54SPQV4SRC2ACYCQLTV","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3687","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3690","title":"chkstat follows untrusted symbolic links","description":"The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.","status":"published","published":"2019-12-05T15:30:15.557Z","modified":"2024-09-16T16:38:49.6Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13325","description":"The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.","status":"published","published":"2019-12-05T15:30:15Z","modified":"2024-09-16T16:38:49Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:49.526752Z"}],"ghsa":[{"id":"GHSA-jxhx-2gqw-c77x","title":"The chkstat tool in the permissions package followed symlinks before commit...","description":"The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.","status":"published","published":"2022-05-24T17:02:46Z","modified":"2023-01-28T05:08:08Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:44:35.9832Z"}],"nvd":[{"id":"CVE-2019-3690","description":"The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.","status":"published","published":"2019-12-05T16:15:11.147Z","modified":"2026-06-17T02:35:23.337Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"openSUSE-SU-2019:2672-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\n- CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid\n  which could have allowed a squid user to gain persistence by changing the \n  binary (bsc#1093414).\n- CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic \n  links (bsc#1150734).\n- Fixed a regression which caused sagmentation fault (bsc#1157198).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2019-12-11T09:15:11Z","modified":"2026-02-04T03:18:49.802941Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11165-1","title":"chkstat-1550_20210901-29.2 on GA media","description":"These are all security issues fixed in the chkstat-1550_20210901-29.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:43.944581Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:14237-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\n- CVE-2019-3690: Fixed a privilege escalation through untrusted symlinks (bsc#1150734). \n","status":"published","published":"2019-12-05T10:44:46Z","modified":"2026-02-04T02:53:15.939444Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:3180-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\n- CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid\n  which could have allowed a squid user to gain persistence by changing the \n  binary (bsc#1093414).\n- CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic \n  links (bsc#1150734).\n- Fixed a regression which caused segmentation fault (bsc#1157198).\n","status":"published","published":"2019-12-05T10:42:59Z","modified":"2026-02-04T02:27:45.860593Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3182-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\t  \n- CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid\n  which could have allowed a squid user to gain persistence by changing the \n  binary (bsc#1093414).\n- CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic \n  links (bsc#1150734).\n- Fixed a regression which caused sagmentation fault (bsc#1157198).\n","status":"published","published":"2019-12-05T10:43:17Z","modified":"2026-02-04T04:26:28.660249Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3183-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\nSecurity issues fixed: \n\n- CVE-2019-3688: Changed wrong ownership in /usr/sbin/pinger to root:squid\n  which could have allowed a squid user to gain persistence by changing the \n  binary (bsc#1093414).\n- CVE-2019-3690: Fixed a privilege escalation through untrusted symbolic \n  links (bsc#1150734).\t  \n\nOther issue addressed: \n\n- Corrected a badly constracted file which could have allowed treating of the\n  shell environment as permissions files (bsc#1097665,bsc#1047247).\n- Fixed a regression which caused sagmentation fault (bsc#1157198). \n","status":"published","published":"2019-12-05T10:43:32Z","modified":"2026-02-04T03:42:26.588868Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:1163-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2020-8013: Fixed a local privilege escalation with mrsh and wodim (bsc#1163922).\n\nNon-security issues fixed:\n\n- Fixed regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)\n- Fixed capability handling when doing multiple permission changes at once (bsc#1161779)\n- Fixed handling of relative directory symlinks in chkstat\n","status":"published","published":"2020-05-04T07:45:16Z","modified":"2026-02-04T04:02:21.105964Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2021:2280-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\n- Fork package for 12-SP5 (bsc#1155939)\n- make btmp root:utmp (bsc#1050467, bsc#1182899)\n- pcp: remove no longer needed / conflicting entries (bsc#1171883). Fixes a potential security issue.\n- do not follow symlinks that are the final path element (CVE-2020-8013, bsc#1163922)\n- fix handling of relative directory symlinks in chkstat\n- whitelist postgres sticky directories (bsc#1123886)\n- fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)\n- fix capability handling when doing multiple permission changes at once (bsc#1161779,\n- fix invalid free() when permfiles points to argv (bsc#1157198)\n- the eror should be reported for permfiles[i], not argv[i], as these are not the same files. (bsc#1047247, bsc#1097665)\n- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414, CVE-2019-3688)\n- fix privilege escalation through untrusted symlinks (bsc#1150734, CVE-2019-3690)\n","status":"published","published":"2021-07-09T14:29:17Z","modified":"2026-02-04T03:26:26.118726Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}