PT-2017-6886 · Debian+1 · Devscripts+1

Adam Mariš · Published 2017-09-06 · Updated 2018-06-16 · CVE-2015-5705

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions devscripts versions prior to 2.15.7

Description The issue allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.

Recommendations For versions prior to 2.15.7, update to version 2.15.7 or later to resolve the issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2018-1905

CVE-2015-5705

Affected Products

Alt Linux

Devscripts

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7050 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163710.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7325 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5705 · Security Note
• https://bdu.fstec.ru/vul/2017-02344 · Security Note
• https://bdu.fstec.ru/vul/2015-02662 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5705 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5705 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5704 · Security Note
• https://osv.dev/vulnerability/CVE-2015-5705 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5705 · Vendor Advisory
• https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=d8f8fa1d8e4151fa62997cb74403f97ab0d7e1a2 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163705.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6888 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1905 · Vendor Advisory