CVE-2019-3010

CVE-2019-3010 is a local privilege escalation flaw in the XScreenSaver component of Oracle Solaris 11, rated 8.8 (High) with the scope-change flag set, meaning the compromise of the component can extend beyond it to the rest of the host. A low-privileged attacker who can log on to the system can trigger the vulnerability with no user interaction or complex preconditions, gaining full takeover of the Solaris host with high confidentiality, integrity, and availability impact. Because of the scope change, Oracle notes that successful attacks may also significantly impact additional products running on the infrastructure. Only Oracle Solaris 11 is listed as affected. A public proof-of-concept exploit has been available since 2019, and the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-25, indicating known exploitation in the wild; ransomware use is unknown.

What to do: Apply the Oracle Solaris 11 security updates per vendor instructions, as required by the CISA KEV catalog entry (added 2022-05-25). Inventory all Solaris 11 hosts—especially those exposing SSH or other logon access to low-privileged users—and prioritize patching internet-reachable or multi-tenant systems. Monitor EPSS (13.4% probability of exploitation within 30 days, 96th percentile) and restrict local accounts on Solaris hosts until patches are applied.