CVE-2019-3690

Name of the Vulnerable Software and Affected Versions permissions package versions prior to commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 openSUSE Leap (affected versions not specified)

Description The issue is related to the chkstat tool in the permissions package, which followed symlinks, allowing local attackers with control over a traversed path to escalate privileges. This is due to errors in handling symbolic links.

Recommendations For versions prior to commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230, consider applying the fix committed in a9e1d26cd49ef9ee0c2060c859321128a6dd4230 and review additional hardenings. For openSUSE Leap, at the moment, there is no information about a newer version that contains a fix for this vulnerability.