CVE-2015-2806: canonical ubuntu_linux

CVSS: 10.0v2.0HighModified

AliasesMGASA-2015-0128SUSE-SU-2015:0904-1UBUNTU-CVE-2015-2806+4 more

Published 10-04-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-2806 is a high (CVSS 10.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 7.75% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

7.75%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 2

OPENSUSE-SU-2024:10414-1 RHSA-2017:1860 SUSE-SU-2016:0077-1

Timeline

10-04-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

7.75%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 7.75% on 18-09-2026

18-09-202618-10-2026

EPSS score

7.75%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Suse4 products

libtasn1&distro=SUSE Linux Enterprise Desktop 12< 3.7-4.1
libtasn1&distro=SUSE Linux Enterprise Server 12< 3.7-4.1
libtasn1&distro=SUSE Linux Enterprise Server for SAP Applications 12< 3.7-4.1
libtasn1&distro=SUSE Linux Enterprise Software Development Kit 12< 3.7-4.1

Debian3 products

libtasn1-3< 2.7-1+squeeze+3 | < 2.13-2+deb7u2
libtasn1-6< 4.2-3
debian_linuxEOL7.0

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10

Fedoraproject1 product

fedoraEOL20 | 21 | 22

Gnu1 product

libtasn1≤ 4.3

Mageia1 product

libtasn1< 3.6-1.1.mga4

Ubuntu1 product

libtasn1-6< 3.4-3ubuntu0.2

7 vendors · 12 products

References

27 links

www.mandriva.com/security/advisories?name=MDVSA-2015:193Vendor AdvisoryX Refsource MANDRIVABroken Link
security.gentoo.org/glsa/201509-04Vendor AdvisoryX Refsource GENTOO
lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.ubuntu.com/usn/USN-2559-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.openwall.com/lists/oss-security/2015/03/31/2Mailing ListX Refsource MLISTThird Party Advisory
www.securitytracker.com/id/1032080VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/bid/73436VDB EntryX Refsource BID

Show all 27 references

access.redhat.com/errata/RHSA-2017:1860Vendor AdvisoryX Refsource REDHAT
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRM
lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.debian.org/security/2015/dsa-3220Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.openwall.com/lists/oss-security/2015/03/29/4Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=4d4f992826a4962790ecd0cce6fbba4a415ce149X Refsource CONFIRM
advisories.mageia.org/MGASA-2015-0128.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=15588REPORT
openwall.com/lists/oss-security/2015/03/31/2WEB
www.suse.com/support/update/announcement/2015/suse-su-20150904-1/Advisory
bugzilla.suse.com/924828REPORT
www.suse.com/security/cve/CVE-2015-2806WEB
ubuntu.com/security/CVE-2015-2806REPORT
ubuntu.com/security/notices/USN-2559-1Advisory
www.cve.org/CVERecord?id=CVE-2015-2806REPORT
security-tracker.debian.org/tracker/CVE-2015-2806Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities