CVE-2015-8768
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.7%
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone.
Produtos afetados
n/a · n/aReferências
http://bazaar.launchpad.net/~click-hackers/click/devel/revision/587https://bugs.launchpad.net/ubuntu/+source/click/+bug/1506467https://code.launchpad.net/~cjwatson/click/audit-missing-dot-slash/+merge/274554https://insights.ubuntu.com/2015/10/15/update-on-ubuntu-phone-security-issue/https://plus.google.com/+SzymonWaliczek/posts/3jbG2uiAniFhttp://ubuntu.com/usn/usn-2771-1http://www.openwall.com/lists/oss-security/2016/01/12/8http://www.securityfocus.com/bid/96386