CVE-2015-1336: man-db_project man-db Improper Access Control
Vulnerability summary
CVE-2015-1336 is a high (CVSS 7.8) Improper Access Control vulnerability in man-db_project man-db. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.8% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 27-09-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
+0.03 pp
From 1.01% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (halfdog.net)
Maturity: unknown
Man-db 2.6.7.1 - Local Privilege Escalation
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian1 product
- man-db< 2.7.6-1
Man-db_project1 product
- man-db≤ 2.7.6.1
Ubuntu1 product
- man-dbAll versions (No fix recorded) | < 2.7.5-1ubuntu0.1~esm1
3 vendors · 3 products
References
13 links- bugs.launchpad.net/ubuntu/+source/man-db/+bug/1482786X Refsource MISCIssue TrackingThird Party Advisory
- packetstormsecurity.com/files/140759/Man-db-2.6.7.1-Privilege-Escalation.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/X Refsource MISCExploitThird Party AdvisoryREPORT
- people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1336.htmlX Refsource MISCThird Party Advisory
- security.gentoo.org/glsa/201707-12Vendor AdvisoryX Refsource GENTOOIssue TrackingThird Party AdvisoryVDB Entry
- www.openwall.com/lists/oss-security/2015/12/14/11Mailing ListX Refsource MLISTThird Party AdvisoryVDB Entry
bugs.debian.org/cgi-bin/bugreport.cgi?bug=840357X Refsource CONFIRMIssue TrackingThird Party Advisory