CVE-2015-1416 : Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10

Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.

Published 2018-02-05 16:29:00

Updated 2018-03-13 19:53:21

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2015-1416

Freebsd » Freebsd » Version: 10.0
cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 10.1
cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 10.2
cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-1416

EPSS FAQ

1.59%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-1416

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-1416

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-1416

http://www.openwall.com/lists/oss-security/2015/08/02/6

oss-security - Re: CVE-2015-1416: vulnerability in patch(1)
Mailing List;Third Party Advisory
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:14.bsdpatch.asc

Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/08/02/1

oss-security - Re: CVE-2015-1416: vulnerability in patch(1)
Mailing List;Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/08/01/4

oss-security - Re: CVE-2015-1416: vulnerability in patch(1)
Mailing List;Third Party Advisory
http://www.securitytracker.com/id/1033110

FreeBSD patch(1) Lets Remote Users Execute Arbitrary Commands on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2015/07/30/9

oss-security - CVE-2015-1416: vulnerability in patch(1)
Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/76116

FreeBSD patch(1) Utility CVE-2015-1416 Command Injection Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2015-1416

Products affected by CVE-2015-1416

Exploit prediction scoring system (EPSS) score for CVE-2015-1416

CVSS scores for CVE-2015-1416

CWE ids for CVE-2015-1416

References for CVE-2015-1416