CVE-2015-0796mediumCWE-434

CVE-2015-0796: falha de média gravidade em SUSE open build service

open build service source server symlink exploitation via source patch

Publicada em · Atualizada em

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.9%
probabilidade de exploração
0.9%top 42% das CVEs
exploração observada
nãonenhuma fonte reporta
In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
SUSE · open build service
CVEs relacionadas — SUSE open build service

No mesmo produto, das mais perigosas para as menos.

CVE-2011-4183MEDIUMopen build service allows anyone to upload rpmsEPSS 1.6%CVE-2011-4181MEDIUMopen build service information leak via unauthorized source accessEPSS 1.4%CVE-2017-9268MEDIUMopen-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissionsEPSS 0.6%
Referências
https://bugzilla.suse.com/show_bug.cgi?id=941099https://github.com/openSUSE/open-build-service/commit/474a3db19498765f0118ba3dbc0b1cc90b0097fc