{"id":"DEBIAN-CVE-2019-12522","details":"An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.","modified":"2026-09-21T07:01:48.794601264Z","published":"2020-04-15T19:15:12.473Z","upstream":["CVE-2019-12522"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2019-12522"}],"affected":[{"package":{"name":"squid","ecosystem":"Debian:12","purl":"pkg:deb/debian/squid?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-2","5.7-2+deb12u1","5.7-2+deb12u2","5.7-2+deb12u3","5.7-2+deb12u4","5.7-2+deb12u5","5.7-2+deb12u6","6.1-1","6.1-2","6.10-1","6.12-1","6.13-1","6.13-2","6.3-1","6.5-1","6.6-1","6.8-1","6.9-1","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-12522.json"}},{"package":{"name":"squid","ecosystem":"Debian:13","purl":"pkg:deb/debian/squid?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13-2","6.13-2+deb13u1","6.13-2+deb13u2","6.13-2+deb13u3","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-12522.json"}},{"package":{"name":"squid","ecosystem":"Debian:14","purl":"pkg:deb/debian/squid?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13-2","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-12522.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}