CVE-2015-1378 : cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x b

cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.

Published 2017-08-07 17:29:00

Updated 2017-08-16 19:05:45

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-1378

Grml » Grml-debootstrap » Version: 0.72
cpe:2.3:a:grml:grml-debootstrap:0.72:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.73
cpe:2.3:a:grml:grml-debootstrap:0.73:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.74
cpe:2.3:a:grml:grml-debootstrap:0.74:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.75
cpe:2.3:a:grml:grml-debootstrap:0.75:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.70
cpe:2.3:a:grml:grml-debootstrap:0.70:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.77
cpe:2.3:a:grml:grml-debootstrap:0.77:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.54
cpe:2.3:a:grml:grml-debootstrap:0.54:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.71
cpe:2.3:a:grml:grml-debootstrap:0.71:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.76
cpe:2.3:a:grml:grml-debootstrap:0.76:*:*:*:*:*:*:*
Matching versions
Grml » Grml-debootstrap » Version: 0.68
cpe:2.3:a:grml:grml-debootstrap:0.68:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-1378

EPSS FAQ

0.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-1378

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2015-1378

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-1378

http://cve.killedkenny.io/cve/CVE-2015-1378

** RESERVED ** · CVE-2015-1378
Third Party Advisory
https://github.com/grml/grml-debootstrap/issues/59

CVE-2015-1378 / Git HEAD: Issues with sourcing cmdlineopts.clp from current working directory · Issue #59 · grml/grml-debootstrap · GitHub
Issue Tracking;Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/01/27/17

oss-security - Re: CVE or not: 2x grml-debootstrap
Mailing List;Third Party Advisory
https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1378.html

CVE-2015-1378 in Ubuntu
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2015-1378/

CVE-2015-1378
Third Party Advisory

Jump to

Vulnerability Details : CVE-2015-1378

Products affected by CVE-2015-1378

Exploit prediction scoring system (EPSS) score for CVE-2015-1378

CVSS scores for CVE-2015-1378

CWE ids for CVE-2015-1378

References for CVE-2015-1378