CVE-2015-5252: canonical ubuntu_linux
CVSS: 7.2v3.1HighModified
AliasesUBUNTU-CVE-2015-5252DEBIAN-CVE-2015-5252
Published 29-12-2015Last modified 06-08-2024
Vulnerability summary
CVE-2015-5252 is a high (CVSS 7.2) vulnerability in canonical ubuntu_linux. EPSS estimates a 13.27% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.2/10
010
High · v3.1 (NVD)EPSS score
13.27%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 14 · Related 7Timeline
- 29-12-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 7.2Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
High 7.2Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
13.27%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.27% on 20-09-2026
20-09-202620-10-2026
EPSS score13.27%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (samba.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- samba< 2:4.1.22+dfsg-1
- debian_linuxEOL7.0 | 8.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10
Samba1 product
- samba≥ 3.0.0, < 4.1.22 | ≥ 4.2.0, < 4.2.7 | ≥ 4.3.0, < 4.3.3
Ubuntu1 product
- samba< 2:4.1.6+dfsg-1ubuntu2.14.04.11 | < 2:4.3.3+dfsg-1ubuntu1
4 vendors · 5 products
References
29 links- lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 29 references
- lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00046.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993X Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory