Read the docs
TI-2019-02719 Aliases CVE-2019-3697GHSA-87jq-f9rw-6m54

Local privilege escalation from user gnump3d to root

Priority LOW 35CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions.

Why it matters now

EPSS 0.00518 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
openSUSELeap 15.1gnump3d – 3.0-lp151.2.1—No fix listedCNA
  • Leap 15.1 VendoropenSUSE Affected gnump3d – 3.0-lp151.2.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gnu:gnump3d:*:*:*:*:*:*:*:*up to 3.0VulnerableGNU
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:gnu:gnump3d:*:*:*:*:*:*:*:* Versions up to 3.0 Vulnerable ·GNU
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3697
  2. 2026-10-03 Alias added: GHSA-87jq-f9rw-6m54

References

Exploit 1

  • TI-2020-12851 An issue was discovered in SaltStack Salt through 3002. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-10051 rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
See all 1897 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences