CVE-2019-36968.4HighCWE-22

CVE-2019-3696: pcp: Local privilege escalation from user pcp to root through migrate_tempdirs

SUSE · SUSE Linux Enterprise High Performance Computing 15-ESPOS

Vendor fix available · Affected: SUSE Linux Enterprise High Performance Computing 15-ESPOS · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

40th percentile

050100

Higher than 40% of scored CVEs

8.4HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.

Affected products10

From the CVE record. A product or version that is not listed is unknown, not unaffected.

SUSE · SUSE Linux Enterprise High Performance Computing 15-ESPOSfrom pcp before 3.11.9-5.8.1
SUSE · SUSE Linux Enterprise High Performance Computing 15-LTSSfrom pcp before 3.11.9-5.8.1
SUSE · SUSE Linux Enterprise Module for Development Tools 15from pcp before 3.11.9-5.8.1
SUSE · SUSE Linux Enterprise Module for Development Tools 15-SP1from pcp before 4.3.1-3.5.3
SUSE · SUSE Linux Enterprise Module for Open Buildservice Development Tools 15from pcp before 3.11.9-5.8.1
SUSE · SUSE Linux Enterprise Server 15-LTSSfrom pcp before 3.11.9-5.8.1
SUSE · SUSE Linux Enterprise Server for SAP 15from pcp before 3.11.9-5.8.1
SUSE · SUSE Linux Enterprise Software Development Kit 12-SP4from pcp before 3.11.9-6.14.1
SUSE · SUSE Linux Enterprise Software Development Kit 12-SP5from pcp before 3.11.9-6.14.1
openSUSE · openSUSE Leap 15.1from pcp before 4.3.1-lp151.2.3.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Path Traversal · File and Path Handling
Vendor: SUSE
Published: March 2020
Band: Unlikely (under 1%), March 2020

CoverageNo articles yet

No CyberSIXT article names CVE-2019-3696 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.