CVE-2015-7545: canonical ubuntu_linux Improper Input Validation
CVSS: 9.8v3.0CriticalModified
AliasesSUSE-SU-2015:2025-1SUSE-SU-2015:2325-1RHSA-2015:2515RHSA-2015:2561UBUNTU-CVE-2015-7545USN-2835-1DEBIAN-CVE-2015-7545DSA-3435-1
Published 13-04-2016Last modified 06-08-2024
Vulnerability summary
CVE-2015-7545 is a critical (CVSS 9.8) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 18.67% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
18.67%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 13-04-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
CVSS metrics
4 scores · 3 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
18.67%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 18.67% on 18-09-2026
18-09-202618-10-2026
EPSS score18.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Redhat34 products
- software_collections1.0
- emacs-git< 0:1.8.3.1-6.el7
- emacs-git-el< 0:1.8.3.1-6.el7
- git< 0:1.8.3.1-6.el7
- git-all< 0:1.8.3.1-6.el7
Suse6 products
- git&distro=SUSE Linux Enterprise Server 12< 1.8.5.6-15.1
- git&distro=SUSE Linux Enterprise Server 12 SP1< 1.8.5.6-15.1
- git&distro=SUSE Linux Enterprise Server for SAP Applications 12< 1.8.5.6-15.1
- git&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 1.8.5.6-15.1
- git&distro=SUSE Linux Enterprise Software Development Kit 12< 1.8.5.6-15.1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10
Debian1 product
- git< 1:2.6.1-1 | < 1:1.7.10.4-1+wheezy2 | < 1:2.1.4-2.1+deb8u1
Git_project1 product
- git≤ 2.3.9 | 2.4.0 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.5 | 2.4.6 | 2.4.7 | 2.4.8 | 2.4.9 | 2.5.0 | 2.5.1 | 2.5.2 | 2.5.3 | 2.6.0
Opensuse1 product
- opensuseEOL13.1 | 13.2
Ubuntu1 product
- git< 1:1.9.1-1ubuntu0.2
7 vendors · 45 products
References
39 links- github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txtX Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
Show all 39 references
- github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txtX Refsource CONFIRMPatchVendor Advisory
- github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txtX Refsource CONFIRMPatchVendor Advisory
- github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txtX Refsource CONFIRMPatchVendor Advisory
- www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255Vendor AdvisoryX Refsource SLACKWARE
- bugzilla.suse.com/948969REPORT
