CVE-2015-7529: canonical ubuntu_linux Link Following
CVSS: 7.8v3.1HighModified
AliasesGHSA-3g56-2hh3-35phPYSEC-2017-73RHSA-2016:0152RHSA-2016:0188UBUNTU-CVE-2015-7529DEBIAN-CVE-2015-7529
Published 06-11-2017Last modified 06-08-2024
Vulnerability summary
CVE-2015-7529 is a high (CVSS 7.8) Link Following vulnerability in canonical ubuntu_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-11-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.
CVSS metrics
6 scores · 4 sources · 3 versionsHigh 8.5Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 19-09-2026
19-09-202619-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.2 | 7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_eus6.7 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server_tus7.2 | 7.3 | 7.6 | 7.7
Canonical1 product
- ubuntu_linuxEOL14.04 | 15.04 | 15.10
Debian1 product
- sosreport< 3.2+git276-g7da50d6-3
PyPI1 product
- sosreport≥ 3.0, < 3.3 | ≥ 3.0 (No fix recorded)
Sos_project1 product
- sos≥ 3.0, ≤ 3.8
Ubuntu1 product
- sosreport< 3.1-1ubuntu2.2
6 vendors · 12 products
References
21 links- www.ubuntu.com/usn/USN-2845-1Vendor AdvisoryX Refsource UBUNTUIssue TrackingThird Party AdvisoryWEBAdvisory
- github.com/sosreport/sos/issues/696X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryWEBREPORT
- rhn.redhat.com/errata/RHSA-2016-0152.htmlVendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- rhn.redhat.com/errata/RHSA-2016-0188.htmlVendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2016:0188X Refsource MISCIssue TrackingThird Party AdvisoryWEBAdvisory
- bugzilla.redhat.com/show_bug.cgi?id=1282542X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEBREPORT
- access.redhat.com/errata/RHSA-2016:0152X Refsource MISCIssue TrackingThird Party AdvisoryWEBAdvisory
Show all 21 references
- github.com/sosreport/sosPACKAGE
