CVE-2019-18932

log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.

• CWE-59
• CWE-362

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/27/1Mailing List, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1150554Issue Tracking, Third Party Advisory
• https://seclists.org/oss-sec/2020/q1/23Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202007-32Third Party Advisory
• https://sourceforge.net/projects/sarg/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/27/1Mailing List, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1150554Issue Tracking, Third Party Advisory
• https://seclists.org/oss-sec/2020/q1/23Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202007-32Third Party Advisory
• https://sourceforge.net/projects/sarg/Third Party Advisory

Published

Jan 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18926Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vu…6.1
• CVE-2019-18928Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows …9.8
• CVE-2019-18929Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows …8.8
• CVE-2019-1893A vulnerability in Cisco Enterprise NFV Infrastructure Softw…7.8
• CVE-2019-18930Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows …8.8
• CVE-2019-18931Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows …8.8
• CVE-2019-18933In Zulip Server versions from 1.7.0 to before 2.0.7, a bug i…9.8
• CVE-2019-18934Unbound 1.6.4 through 1.9.4 contain a vulnerability in the i…7.3
• CVE-2019-18935Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 con…9.8
• CVE-2019-18936UniValue::read() in UniValue before 1.0.5 allow attackers to…7.5
• CVE-2019-18937eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script…9.8
• CVE-2019-18938eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail…9.8