« Volver al listado

CVE-2015-0796

Estado: ModificadaAlta (7.8)—

n open buildservice, en versiones 2.6 anteriores a la 2.6.3, versiones 2.5 anteriores a la 2.5.7 y versiones 2.4 anteriores a la 2.4.8, la aplicación origen de parche de servicio podría generar archivos no estándar como symlinks o nodos de dispositivo. Esto podría permitir que los usuarios buildservice salgan de su confinamiento o provoquen ataques de denegación de servicio (DoS) en el servicio origen.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opensuse — Open Buildservice

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0796",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "open build service",
          "versions": [
            {
              "status": "affected",
              "version": "2.6",
              "lessThan": "2.6.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.5",
              "lessThan": "2.5.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.4",
              "lessThan": "2.4.8",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-02T20:29:00.207",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=941099",
      "source": "security@opentext.com"
    },
    {
      "url": "https://github.com/openSUSE/open-build-service/commit/474a3db19498765f0118ba3dbc0b1cc90b0097fc",
      "source": "security@opentext.com"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=941099",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/openSUSE/open-build-service/commit/474a3db19498765f0118ba3dbc0b1cc90b0097fc",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@opentext.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service."
    },
    {
      "lang": "es",
      "value": "n open buildservice, en versiones 2.6 anteriores a la 2.6.3, versiones 2.5 anteriores a la 2.5.7 y versiones 2.4 anteriores a la 2.4.8, la aplicación origen de parche de servicio podría generar archivos no estándar como symlinks o nodos de dispositivo. Esto podría permitir que los usuarios buildservice salgan de su confinamiento o provoquen ataques de denegación de servicio (DoS) en el servicio origen."
    }
  ],
  "lastModified": "2026-06-17T00:20:54.790",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:open_buildservice:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4AF3CA3-F883-4301-85CD-2C71DB0FD6F3",
              "versionEndExcluding": "2.4.8",
              "versionStartIncluding": "2.4"
            },
            {
              "criteria": "cpe:2.3:a:opensuse:open_buildservice:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "701DD07C-6709-4E18-A2A5-BEF1482B21FC",
              "versionEndExcluding": "2.5.7",
              "versionStartIncluding": "2.5"
            },
            {
              "criteria": "cpe:2.3:a:opensuse:open_buildservice:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5241ECAA-7075-4CD1-87D3-5ADD1840E81E",
              "versionEndExcluding": "2.6.3",
              "versionStartIncluding": "2.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}