PT-2016-3673 · Criu Team · Criu

Florian Weimer · Publicado 2016-06-07 · Atualizado 2024-06-15 · CVE-2015-5228

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CRIU (affected versions not specified)

Description The issue concerns the service daemon in CRIU, which creates log and dump files insecurely. This insecurity allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-5228

OPENSUSE-SU-2024:10278-1

Produtos afetados

Criu

Referências · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5228 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/08/25/5 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-5228 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10278-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-5228 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-5228 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1255782 · Nota
• https://suse.com/security/cve/CVE-2015-5231 · Nota
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00030.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5228 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-5228 · Aviso do Fabricante
• https://lists.openvz.org/pipermail/criu/2015-August/021847.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-5228 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5228 · Aviso do Fabricante