{"id":"CVE-2019-3693","aliases":["EUVD-2019-13328","GHSA-mjp9-97x3-23vj","SUSE-SU-2019:14230-1","SUSE-SU-2019:3076-1","openSUSE-SU-2020:0148-1","openSUSE-SU-2020:0156-1"],"status":"published","title":"Local privilege escalation from user wwwrun to root in the packaging of mailman","description":"A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00365,"percentile":0.30585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2019-11-25T16:29:21Z","modified":"2026-06-17T02:35:23Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mailman","fixed_in":["2.1.15-9.6.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mailman","fixed_in":["2.1.15-9.6.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"mailman","fixed_in":["2.1.17-3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"mailman","fixed_in":["2.1.29-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"mailman","fixed_in":["2.1.29-bp151.5.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.29-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.29-bp151.5.3.1"}]}]}],"products":[{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap 15.1"},{"vendor":"suse","product":"mailman"},{"vendor":"suse","product":"suse linux enterprise server 11"},{"vendor":"suse","product":"suse linux enterprise server 12"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1154328","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3693"},{"url":"https://github.com/advisories/GHSA-mjp9-97x3-23vj"},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914230-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1154328","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3693","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193076-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JZBF7GOXNJX7FAHTZ25MQVPYYL5S3MAW/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMGU7U75MH52MOBH2ERROW6BFVQWCEJD/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-3693","title":"Local privilege escalation from user wwwrun to root in the packaging of mailman","description":"A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.","status":"published","published":"2020-01-24T10:05:17.025Z","modified":"2024-09-17T02:46:37.656Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-13328","description":"A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.","status":"published","published":"2020-01-24T10:05:17Z","modified":"2024-09-17T02:46:37Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:37.764675Z"}],"ghsa":[{"id":"GHSA-mjp9-97x3-23vj","title":"A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11,...","description":"A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.","status":"published","published":"2022-05-24T17:07:18Z","modified":"2023-01-30T05:06:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:47:30.961059Z"}],"nvd":[{"id":"CVE-2019-3693","description":"A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.","status":"published","published":"2020-01-24T10:15:12.053Z","modified":"2026-06-17T02:35:23.72Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"openSUSE-SU-2020:0148-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\n  - CVE-2019-3693: Fixed a privilege escalation during package install. Could be \n    exploited by a local users who is members of the the mailman group. (boo#1154328)\n","status":"published","published":"2020-01-29T17:10:27Z","modified":"2026-02-04T04:23:45.421113Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0156-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\n  - CVE-2019-3693: Fixed a privilege escalation during package install. Could be \n    exploited by a local users who is members of the the mailman group. (boo#1154328)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-02-03T23:14:43Z","modified":"2026-02-04T02:57:34.173939Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2019:14230-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\t  \n- CVE-2019-3693: Fixed a local privilege escalation from wwwrun to root (bsc#1154328).\n","status":"published","published":"2019-11-25T16:29:21Z","modified":"2026-02-04T03:26:56.009406Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:3076-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\t  \n- CVE-2019-3693: Fixed a local privilege escalation from wwwrun to root (bsc#1154328).\n\n","status":"published","published":"2019-11-26T16:46:44Z","modified":"2026-02-04T03:14:00.750923Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}