CVE-2019-3695

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
SUSESUSE Linux Enterprise High Performance Computing 15-ESPOS>= pcp, < 3.11.9-5.8.1
SUSESUSE Linux Enterprise High Performance Computing 15-LTSS>= pcp, < 3.11.9-5.8.1
SUSESUSE Linux Enterprise Module for Development Tools 15>= pcp, < 3.11.9-5.8.1
SUSESUSE Linux Enterprise Module for Development Tools 15-SP1>= pcp, < 4.3.1-3.5.3
SUSESUSE Linux Enterprise Module for Open Buildservice Development Tools 15>= pcp, < 3.11.9-5.8.1
SUSESUSE Linux Enterprise Server 15-LTSS>= pcp, < 3.11.9-5.8.1
SUSESUSE Linux Enterprise Server for SAP 15>= pcp, < 3.11.9-5.8.1
SUSESUSE Linux Enterprise Software Development Kit 12-SP4>= pcp, < 3.11.9-6.14.1
SUSESUSE Linux Enterprise Software Development Kit 12-SP5>= pcp, < 3.11.9-6.14.1
openSUSEopenSUSE Leap 15.1>= pcp, < 4.3.1-lp151.2.3.1

References

Timeline

Published
Mar 3, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-36967.3A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High PerformancCVE-2019-36977.8UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate frCVE-2019-36987.0UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux EnterCVE-2019-36997.8UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to esCVE-2019-37003.3yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secureCVE-2019-37014.4An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwisCVE-2019-37028.8A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute CVE-2019-37047.8VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate CVE-2019-37059.8Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.2CVE-2019-37069.8Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remoteCVE-2019-37079.8Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this CVE-2019-37089.6IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an a
CVE-2019-3695: High severity, CVSS 7.8 | Vulnix