CVE-2015-10088 : A vulnerability, which was classified as critical, was found in ayttm up to 0.5.

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 40e04680018614a7d2b68566b261b061a0597046. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222267.

Published 2023-03-05 05:15:09

Updated 2024-05-17 01:03:07

Source VulDB

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2015-10088

Ayttm Project » Ayttm
Versions up to, including, (<=) 0.5.0-89
cpe:2.3:a:ayttm_project:ayttm:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-10088

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-10088

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.6	MEDIUM	AV:N/AC:H/Au:S/C:P/I:P/A:P	3.9	6.4	VulDB
Access Vector: Network Access Complexity: High Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
5.0	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	1.6	3.4	VulDB
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
5.0	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	1.6	3.4	VulDB	2024-02-15
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST	2024-02-15
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-10088

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2015-10088

https://github.com/ayttm/ayttm/commit/40e04680018614a7d2b68566b261b061a0597046

Fix format string vulnerability · ayttm/ayttm@40e0468 · GitHub
Patch
https://vuldb.com/?ctiid.222267

Login required
Permissions Required;Third Party Advisory
https://vuldb.com/?id.222267

Login required
Third Party Advisory
https://sourceforge.net/p/ayttm/mailman/message/34397158/

[Ayttm-users] Possible format string vulnerability | Ayttm - unified instant messenger client
Third Party Advisory

Jump to

Vulnerability Details : CVE-2015-10088

Products affected by CVE-2015-10088

Exploit prediction scoring system (EPSS) score for CVE-2015-10088

CVSS scores for CVE-2015-10088

CWE ids for CVE-2015-10088

References for CVE-2015-10088