CVE-2019-3693

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
SUSE	SUSE Linux Enterprise Server 11	>= mailman, < 2.1.15-9.6.15.1
SUSE	SUSE Linux Enterprise Server 12	>= mailman, < 2.1.17-3.11.1
openSUSE	Leap 15.1	>= mailman, <= 2.1.29-lp151.2.14

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.htmlMailing List, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.htmlMailing List, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1154328Issue Tracking, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.htmlMailing List, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.htmlMailing List, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1154328Issue Tracking, Vendor Advisory

Timeline

Published: Jan 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-36947.8A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalat CVE-2019-36957.8A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS,CVE-2019-36967.3A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performanc CVE-2019-36977.8UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate fr CVE-2019-36987.0UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enter CVE-2019-36997.8UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to es CVE-2019-37003.3yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure CVE-2019-37014.4An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwis CVE-2019-37028.8A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute CVE-2019-37047.8VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate CVE-2019-37059.8Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.2 CVE-2019-37069.8Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote