7.5

CVE-2015-0860: canonical ubuntu_linux Numeric Errors

CVSS: 7.5v2.0HighModified
AliasesMGASA-2015-0482SUSE-SU-2017:1096-1UBUNTU-CVE-2015-0860
Published 03-12-2015Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2015-0860 is a high (CVSS 7.5) Numeric Errors vulnerability in canonical ubuntu_linux. EPSS estimates a 4.99% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
4.99%
0%100%
Low · -0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 03-12-2015
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

4.99%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

-0.04 pp

From 5.04% on 18-09-2026

18-09-202618-10-2026
EPSS score
4.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse3 products
  • update-alternatives&distro=SUSE Linux Enterprise Desktop 12 SP1< 1.16.10-12.6.1
  • update-alternatives&distro=SUSE Linux Enterprise Server 12 SP1< 1.16.10-12.6.1
  • update-alternatives&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 1.16.10-12.6.1
Debian2 products
  • dpkg< 1.18.4 | < 1.16.17 | < 1.17.26
  • dpkg1.16.0 | 1.16.0.1 | 1.16.0.2 | 1.16.0.3 | 1.16.1 | 1.16.1.1 | 1.16.1.2 | 1.16.2 | 1.16.3 | 1.16.4 | 1.16.4.1 | 1.16.4.2 | 1.16.4.3 | 1.16.5 | 1.16.6 | 1.16.7 | 1.16.8 | 1.16.9 | 1.16.10 | 1.16.15 | 1.17.0 | 1.17.1 | 1.17.2 | 1.17.3 | 1.17.4 | 1.17.5 | 1.17.6 | 1.17.7 | 1.17.8 | 1.17.9 | 1.17.10 | 1.17.11 | 1.17.12 | 1.17.13 | 1.17.14 | 1.17.15 | 1.17.16 | 1.17.17 | 1.17.18 | 1.17.19 | 1.17.20 | 1.17.21 | 1.17.22 | 1.17.23 | 1.17.24 | 1.17.25
Canonical1 product
Mageia1 product
  • dpkg< 1.17.26-1.mga5
Ubuntu1 product
  • dpkg< 1.17.5ubuntu5.5

5 vendors · 8 products

References

16 links
Show all 16 references