DEBIAN-CVE-2019-3689

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2019-3689
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-3689.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2019-3689
Upstream
Published
2019-09-19T14:15:10Z
Modified
2025-09-19T06:21:30Z
Summary
[none]
Details

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.

References

Affected packages

Debian:11 / nfs-utils

Package

Name
nfs-utils
Purl
pkg:deb/debian/nfs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.4-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / nfs-utils

Package

Name
nfs-utils
Purl
pkg:deb/debian/nfs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.4-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / nfs-utils

Package

Name
nfs-utils
Purl
pkg:deb/debian/nfs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.4-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / nfs-utils

Package

Name
nfs-utils
Purl
pkg:deb/debian/nfs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.4-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}