CVE-2019-3699: Local privilege escalation from user privoxy to root
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-3699.
What is the severity of CVE-2019-3699?
CVE-2019-3699 has a severity score of 7.8 (high).
Which software versions are affected by CVE-2019-3699?
CVE-2019-3699 affects openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions, as well as openSUSE Factory privoxy version 3.0.28-2.1 and prior versions.
How does this vulnerability allow local attackers to escalate privileges?
This vulnerability allows local attackers to escalate from user privoxy to root by exploiting a symbolic link (symlink) following vulnerability in the packaging of privoxy.
Is openSUSE Leap 15.1 vulnerable to CVE-2019-3699?
Yes, openSUSE Leap 15.1 is vulnerable to CVE-2019-3699 if privoxy version 3.0.28-lp151.1.1 or a prior version is used.