What’s Vulnerable › Vulnerabilities

CVE-2019-5164

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-03 · updated 2026-06-17
• Weakness: CWE-306

Description

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

Affected products

• openSUSE Backports Sle: 15.0-sp1
• openSUSE Leap: 15.1
• Shadowsocks: 3.3.2

References

• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0958
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0958

Get alerted when CVE-2019-5164 or the next vulnerability affects your stack