CVE-2019-8455

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-65 CWE-59

Affected software

Vendor	Product	Versions
n/a	Check Point ZoneAlarm	up to 15.4.062

References

http://www.securityfocus.com/bid/108029Third Party Advisory, VDB Entry
https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960Vendor Advisory
http://www.securityfocus.com/bid/108029Third Party Advisory, VDB Entry
https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960Vendor Advisory

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-84565.9Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration CVE-2019-84579.8SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree t CVE-2019-84584.4Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL CVE-2019-84599.8Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the pa CVE-2019-84607.5OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() fo CVE-2019-84617.8Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean im CVE-2019-84627.5In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique co CVE-2019-84637.5A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service l CVE-2019-85023.3An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12 CVE-2019-85038.8A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iC CVE-2019-85045.5A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A local us CVE-2019-85056.1A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a