CVE-2019-5164
Fixed in a distro release EPSS <1%CVSS 7.8
An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.
Products: shadowsocks-libev, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | shadowsocks-libev | 3.3.3+ds-2 |
| Debian 13 | shadowsocks-libev | 3.3.3+ds-2 |
| SUSE Package Hub 15 SP1 | shadowsocks-libev | 3.3.3-bp151.5.3.1 |
| Ubuntu 18.04 LTS | shadowsocks-libev | no fix |
| openSUSE Leap 15.1 | shadowsocks-libev | 3.3.3-lp151.2.3.1 |
| openSUSE Tumbleweed | shadowsocks-libev | 3.3.5-1.9 |