CVE catalog

CVE-2019-18932

sarg: CVE-2019-18932

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 25, 2026

log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansargsid2.4.0-4fixed
Debiansargforky2.4.0-4fixed
Debiansargtrixie2.4.0-4fixed
Debiansargbookworm2.4.0-3fixed
Opensusesargleap 15.12.3.10-lp151.3.3.1fixed
Ubuntusarg16.042.3.10-1ubuntu1vulnerable
Ubuntusarg16.042.3.10-2vulnerable
Ubuntusarg18.042.3.10-2vulnerable
Ubuntusarg18.042.3.11-1vulnerable
Ubuntusarg20.042.3.11-1vulnerable
Susesargpackage hub 15 sp12.3.10-bp151.4.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansargsourcesid2.4.0-1unimportantNot reported[951390]
Debiansargsourceforky2.4.0-1unimportantNot reported[951390]
Debiansargsourcetrixie2.4.0-1unimportantNot reported[951390]
Debiansargsourcebookworm2.4.0-1unimportantNot reported[951390]
Opensusesargrpmleap 15.12.3.10-lp151.3.3.1Not reportedOPENSUSE-SU-2020:0117-1Not reported
Susesargrpmpackage hub 15 sp12.3.10-bp151.4.3.1Not reportedOPENSUSE-SU-2020:0140-1Not reported

[Debian bug #951390]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [sarg]Fixed
    Details (2)

    • 2.4.0-3 · amd64 · bookworm

      Fixed · Fixed: 2.4.0-1

      dsa · sarg · debian · bookworm; dsa · sarg · debian · 12

    • 2.4.0-3 · arm64 · bookworm

      Fixed · Fixed: 2.4.0-1

      dsa · sarg · debian · bookworm; dsa · sarg · debian · 12

[Debian 13 (Trixie)]

  • [sarg]Fixed

    Source package: [sarg]

    Details (2)

    • 2.4.0-4+b1 · amd64 · trixie

      Fixed · Fixed: 2.4.0-1

      dsa · sarg · debian · 13

    • 2.4.0-4+b2 · arm64 · trixie

      Fixed · Fixed: 2.4.0-1

      dsa · sarg · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]