CVE catalog

CVE-2019-18898

Security update for trousers

Severity: Medium · CVSS 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: Dec 19, 2019, 3:13:16 PM UTC
Updated: Feb 4, 2026, 4:35:40 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.48% · Oct 25, 2026

This update for trousers fixes the following issues: - CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package (bsc#1157651).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Suse	trousers	linux enterprise module for basesystem 15 sp1	`0.3.14-6.3.1`	fixed
Opensuse	trousers	tumbleweed	`0.3.15-1.7`	fixed
Opensuse	trousers	leap 15.1	`0.3.14-lp151.4.3.1`	fixed
Opensuse	trousers	leap 15.1	`0.3.14-lp151.4.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Suse	trousers	rpm	linux enterprise module for basesystem 15 sp1	`0.3.14-6.3.1`	Not reported	SUSE-SU-2019:3349-1	Not reported
Opensuse	trousers	rpm	tumbleweed	`0.3.15-1.7`	Not reported	OPENSUSE-SU-2024:11476-1	Not reported
Opensuse	trousers	rpm	leap 15.1	`0.3.14-lp151.4.3.1`	Not reported	OPENSUSE-SU-2020:0015-1	Not reported
Opensuse	trousers	rpm	leap 15.1	`0.3.14-lp151.4.6.1`	Not reported	OPENSUSE-SU-2020:0744-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libtspi1]Unknown
Source package: [trousers]
Details (1)
- 0.3.15-9.4 · x86_64 · tumbleweed
  Unknown · Fixed: 0.3.15-1.7
  Version impact unknown
  pypi · trousers · opensuse · tumbleweed
[trousers-devel]Unknown
Source package: [trousers]
Details (1)
- 0.3.15-9.4 · x86_64 · tumbleweed
  Unknown · Fixed: 0.3.15-1.7
  Version impact unknown
  pypi · trousers · opensuse · tumbleweed
[trousers]Fixed
Source package: [trousers]
Details (1)
- 0.3.15-9.4 · x86_64 · tumbleweed
  Fixed · Fixed: 0.3.15-1.7
  pypi · trousers · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:42:14 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]