CVE-2019-18898

trousers: Local privilege escalation from tss to root

HIGH

7.8

CVSS Score

Published: January 23, 2020 at 02:05 PM UTC

Updated: June 17, 2026 at 02:25 AM UTC

6 products affected across 2 vendorsLeapTrousersSUSE Linux Enterprise Server

Using SUSE Linux Enterprise Server 15 SP1 by SUSE?

Get instant alerts when new vulnerabilities affect SUSE Linux Enterprise Server 15 SP1 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.5%

Description

UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Leap · openSUSEdrupal

95%

15.1

Trousers · SUSE

95%

v < 0.3.14-6.3.1v < 0.3.14-7.1

Affected range stops below 0.3.14-6.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.3.14-7.1, so it looks safe — our inference, not a vendor statement

suse-opensuse-factory (environment) · suse-suse-linux-enterprise-server (environment)

Factory · openSUSE

60%

trousers ≤ v < 0.3.14-7.1trousers

Affected range stops below 0.3.14-7.1, so it looks safe — our inference, not a vendor statement

Linux Enterprise Server · SUSE

60%

trousers ≤ v < 0.3.14-6.3.1trousers

Affected range stops below 0.3.14-6.3.1, so it looks safe — our inference, not a vendor statement

openSUSE Factory · SUSEdevice

80%

All versions

SUSE Linux Enterprise Server · SUSEdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00066.html

x_refsource_CONFIRMExploitIssue TrackingVendor Advisory

Source: [email protected]

https://bugzilla.suse.com/show_bug.cgi?id=1157651

CVSS

7.8HIGH[email protected]

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-59

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card