PT-2017-13970 · Scala+1 · Scala+1

Published 2017-11-15 · Updated 2021-06-15 · CVE-2017-15288

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Scala versions 2.10.0 through 2.10.6 Scala versions 2.11.0 through 2.11.11 Scala versions 2.12.0 through 2.12.3

Description The compilation daemon in Scala uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port. This allows local users to write to arbitrary class files and gain privileges.

Recommendations For Scala versions 2.10.0 through 2.10.6, update to version 2.10.7 or later. For Scala versions 2.11.0 through 2.11.11, update to version 2.11.12 or later. For Scala versions 2.12.0 through 2.12.3, update to version 2.12.4 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2021-1999

CVE-2017-15288

GHSA-QVXV-PMQ9-4Q7G

Affected Products

Alt Linux

Scala

References · 52

• https://github.com/scala/scala/pull/6120 · Patch
• https://github.com/scala/scala/pull/6108 · Patch
• https://osv.dev/vulnerability/GHSA-qvxv-pmq9-4q7g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15288 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15288 · Vendor Advisory
• http://scala-lang.org/news/security-update-nov17.html · Vendor Advisory
• https://security.gentoo.org/glsa/201812-08 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15288 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15288 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-1999 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15288 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15288 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15288 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15288 · Security Note
• https://github.com/scala/scala/pull/6128 · Note