Description
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | SUSE Linux Enterprise Debuginfo 11-SP3 | syslog-ng – < 2.0.9-27.34.40.5.1 | 2.0.9-27.34.40.5.1 |
| SUSE | SUSE Linux Enterprise Debuginfo 11-SP4 | syslog-ng – < 2.0.9-27.34.40.5.1 | 2.0.9-27.34.40.5.1 |
| SUSE | SUSE Linux Enterprise Module for Legacy Software 12 | syslog-ng – < 3.6.4-12.8.1 | 3.6.4-12.8.1 |
| SUSE | SUSE Linux Enterprise Point of Sale 11-SP3 | syslog-ng – < 2.0.9-27.34.40.5.1 | 2.0.9-27.34.40.5.1 |
| SUSE | SUSE Linux Enterprise Server 11-SP4-LTSS | syslog-ng – < 2.0.9-27.34.40.5.1 | 2.0.9-27.34.40.5.1 |
| SUSE | SUSE Linux Enterprise Server for SAP 12-SP1 | syslog-ng – < 3.6.4-12.8.1 | 3.6.4-12.8.1 |
| openSUSE | openSUSE Backports SLE-15-SP1 | syslog-ng – < 3.19.1-bp151.4.6.1 | 3.19.1-bp151.4.6.1 |
| openSUSE | openSUSE Leap 15.1 | syslog-ng – < 3.19.1-lp151.3.6.1 | 3.19.1-lp151.3.6.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | syslog-ng | 3.6.4-12.8.1 | SUSE-SU-2020:1221-1 |
| SLES 11 SP4 | syslog-ng | 2.0.9-27.34.40.5.1 | SUSE-SU-2020:14369-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | syslog-ng | 3.6.4-12.8.1 | SUSE-SU-2020:1221-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | syslog-ng | 2.0.9-27.34.40.5.1 | SUSE-SU-2020:14369-1 |
Advisories 2
- SUSE-SU-2020:14369-1 Security update for syslog-ng SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1221-1 Security update for syslog-ng SUSE / openSUSE Security Updates · Feb 4, 2026