CVE-2015-7529

Description

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.058

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2015-3171,CVE-2015-7529 are fixed in Python-sosreport 3.3	Windows
Set of tools to gather troubleshooting data from a system (USN-2845-1) sosreport_3.1-1ubuntu2.2_i386.deb	Linux
Set of tools to gather troubleshooting data from a system (USN-2845-1) sosreport_3.1-1ubuntu2.2_amd64.deb	Linux
Set of tools to gather troubleshooting data from a system (USN-2845-1) sosreport_3.2-2ubuntu0.1_i386.deb	Linux
Set of tools to gather troubleshooting data from a system (USN-2845-1) sosreport_3.2-2ubuntu0.1_amd64.deb	Linux
Set of tools to gather troubleshooting data from a system (USN-2845-1) sosreport_3.2-2ubuntu1_i386.deb	Linux
Set of tools to gather troubleshooting data from a system (USN-2845-1) sosreport_3.2-2ubuntu1_amd64.deb	Linux
(RHSA-2016:0152) Moderate: sos security and bug fix update sos-3.2-28.el6_7.2.noarch.rpm	Linux
(RHSA-2016:0188)Moderate: security and bug fix update sos-3.2-35.el7_2.3.noarch.rpm	Linux
Vulnerabilities CVE-2015-3171,CVE-2015-7529 are fixed in Python-sosreport for linux 3.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234