Vulnerability Details : CVE-2015-2675
The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2015-2675
- cpe:2.3:a:gnome:librest:0.7.92:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-2675
3.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-2675
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2015-2675
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-2675
-
https://bugzilla.gnome.org/show_bug.cgi?id=742644
Bug 742644 – oauth: Implicit declaration of rest_proxy_call_get_url leads to memory errorIssue Tracking;Third Party Advisory;VDB Entry
-
https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea03817acdad87fb2b338a86018329
oauth: Add missing include (b50ace77) · Commits · GNOME / librest · GitLabPatch;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2015/03/23/8
oss-security - Re: CVE request: Invalid pointer dereference in the GNOME librest libraryMailing List;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1183982
1183982 – Memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_urlIssue Tracking;Third Party Advisory;VDB Entry
-
https://bugzilla.redhat.com/show_bug.cgi?id=1199049
1199049 – (CVE-2015-2675) CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_urlIssue Tracking;Patch;Third Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2015-2237.html
RHSA-2015:2237 - Security Advisory - Red Hat Customer PortalThird Party Advisory;VDB Entry
Jump to