CVE-2015-7810 : libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when

libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files

Published 2019-11-22 15:15:11

Updated 2020-08-18 15:05:58

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-7810

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Videolan » Libbluray
Versions before (<) 0.8.0
cpe:2.3:a:videolan:libbluray:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 17
cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 18
cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:L/AC:M/Au:N/C:N/I:P/A:P	3.4	4.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
4.7	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N	1.0	3.6	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

Assigned by: nvd@nist.gov (Primary)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7810

959433 – (CVE-2015-7810) CVE-2015-7810 libbluray (MountManager): TOCTOU race when expanding JAR files
Exploit;Issue Tracking;Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2015-7810

CVE-2015-7810
Third Party Advisory
https://access.redhat.com/security/cve/cve-2015-7810

Red Hat Customer Portal
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/12/7

oss-security - Re: CVE request: BD-J implementation in libbluray
Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/72769

libbluray Symlink Attack Local Security Bypass Vulnerability
Third Party Advisory;VDB Entry

Jump to