PT-2015-2717 · None+1 · Util-Linux+1

Martin Prpič · Published 2015-11-05 · Updated 2024-06-15 · CVE-2015-5218

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.27

Description The issue is related to a buffer overflow in the text-utils/colcrt.c file in the colcrt component of the util-linux utility. This can be exploited by local users through a crafted file, potentially causing a denial of service (crash), and is related to the page global variable.

Recommendations For versions prior to 2.27, update to version 2.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the colcrt component until a patch is available.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-12082

CVE-2015-5218

MGASA-2015-0434

OPENSUSE-SU-2024:10279-1

SUSE-RU-2016:1515-1

SUSE-SU-2017:2699-1

SUSE-SU-2021:14693-1

Affected Products

Suse

Util-Linux

References · 61

• 🔥 http://spinics.net/lists/util-linux-ng/msg11873.html · Exploit
• https://cve.org/CVERecord?id=CVE-2015-5218 · Security Note
• ❌ https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec · Patch, Deleted
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00035.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5218 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5218 · Vendor Advisory
• https://kernel.org/pub/linux/utils/util-linux/v2.27/v2.27-ReleaseNotes · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0434 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14693-1 · Vendor Advisory
• ❌ https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8 · Patch, Deleted
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5218 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2016:1515-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5218 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10279-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0434.html · Security Note