Vulnerability Name:

CVE-2015-1345 (CCN-101351)

Assigned:2015-01-18
Published:2015-01-18
Updated:2018-10-30
Summary:The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
1.6 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
1.2 Low (REDHAT CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:P)
0.9 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-119
CWE-122
CWE-125
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2015-1345

Source: CONFIRM
Type: Exploit
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=19563

Source: CONFIRM
Type: UNKNOWN
http://git.savannah.gnu.org/cgit/grep.git/commit/?id=83a95bd8c8561875b948cadd417c653dbe7ef2e2

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2015:0243

Source: REDHAT
Type: UNKNOWN
RHSA-2015:1447

Source: CCN
Type: GNU Project - Free Software Foundation Web site
Grep - GNU Project - Free Software Foundation

Source: CCN
Type: IBM Security Bulletin T1023373 (PowerKVM)
Vulnerability in GNU Grep affects PowerKVM (CVE-2015-1345)

Source: CCN
Type: IBM Security Bulletin 1972209
Vulnerabilities in GNU grep utility affect IBM Security Network Protection (CVE-2012-5667, and CVE-2015-1345)

Source: CCN
Type: IBM Security Bulletin C1000040 (SmartCloud Provisioning)
Multiple vulnerabilities in GNU grep affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance (CVE-2015-1345, CVE-2012-5667)

Source: MLIST
Type: UNKNOWN
[oss-security] 20150122 Re: CVE request: grep heap buffer overrun

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: BID
Type: UNKNOWN
72281

Source: CCN
Type: BID-72281
grep 'kwset.c' Remote Buffer Overflow Vulnerability

Source: CCN
Type: Red Hat Bugzilla – Bug 1183651
(CVE-2015-1345) CVE-2015-1345 grep: heap buffer overrun

Source: XF
Type: UNKNOWN
grep-cve20151345-bo(101351)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-1345

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:grep:2.19:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:grep:2.20:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:grep:2.21:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 10:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:grep:2.21:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:smartcloud_provisioning:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:security_network_protection_firmware:5.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:powerkvm:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:security_network_protection_firmware:5.3.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:security_network_protection_firmware:5.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20151345
    V
    		CVE-2015-1345
    2023-06-22
    oval:org.opensuse.security:def:7517
    P
    		grep-3.1-150000.4.6.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:670
    P
    		Security update for keylime (Important)
    2022-08-03
    oval:org.opensuse.security:def:2941
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94571
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:88
    P
    		kdump-0.9.0-16.1 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:73
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:370
    P
    		tmux-3.1c-1.38 on GA media (Moderate)
    2022-06-10
    oval:org.opensuse.security:def:100439
    P
    		 (Important)
    2022-03-23
    oval:org.opensuse.security:def:112359
    P
    		grep-2.27-2.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:70857
    P
    		Security update for MozillaFirefox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:105871
    P
    		Security update for clamav (Moderate)
    2021-12-06
    oval:org.opensuse.security:def:69762
    P
    		Security update for aaa_base (Moderate)
    2021-12-03
    oval:org.opensuse.security:def:96579
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:103269
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:89614
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71200
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61459
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:47162
    P
    		syslog-service-2.0-778.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:46906
    P
    		clamav-0.99.2-25.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48017
    P
    		ghostscript-9.27-23.28.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47524
    P
    		vsftpd-3.0.2-39.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47220
    P
    		cifs-utils-6.5-8.9 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48119
    P
    		libgraphite2-3-1.3.1-10.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47670
    P
    		libX11-6-1.6.2-12.5.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47444
    P
    		memcached-1.4.33-3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47766
    P
    		libpng16-16-1.6.8-14.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47806
    P
    		libvncclient0-0.9.9-17.5.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47070
    P
    		libqt4-32bit-4.8.6-7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:46892
    P
    		apache2-mod_nss-1.0.14-18.3 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47952
    P
    		apache2-mod_nss-1.0.14-19.9.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47310
    P
    		libX11-6-1.6.2-11.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47027
    P
    		libhivex0-1.3.10-4.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48048
    P
    		jakarta-commons-fileupload-1.1.1-122.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47608
    P
    		file-5.22-10.6.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47352
    P
    		libgypsy0-0.9-6.22 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47735
    P
    		libldb1-1.1.29-3.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47592
    P
    		dbus-1-glib-0.100.2-3.58 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:46938
    P
    		fetchmail-6.3.26-12.3 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:46891
    P
    		apache2-mod_jk-1.2.40-5.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47837
    P
    		opie-2.4-724.56 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47890
    P
    		squashfs-4.3-6.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:71832
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62091
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100849
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:1002
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:48811
    P
    		libzmq3-4.0.4-6.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:46610
    P
    		ant-1.9.4-1.31 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:70918
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:46745
    P
    		liblzo2-2-2.08-1.13 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:70970
    P
    		libevent-2_1-8-2.1.8-2.23 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48475
    P
    		libXv1-1.0.10-3.56 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:61177
    P
    		grep-3.1-2.20 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:46609
    P
    		alsa-1.0.27.2-11.10 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48757
    P
    		rhythmbox-3.0.2-1.92 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:46624
    P
    		binutils-2.25.0-13.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48529
    P
    		libnm-glib-vpn1-1.0.12-8.6 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:69657
    P
    		Security update for djvulibre (Important)
    2021-06-04
    oval:org.opensuse.security:def:107105
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:116663
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:93726
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71500
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49057
    P
    		telepathy-gabble-0.18.3-5.7 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61759
    P
    		grep-3.1-4.3.12 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:64270
    P
    		Security update for python (Important)
    2020-12-02
    oval:org.opensuse.security:def:66406
    P
    		grep on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64183
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:67617
    P
    		grep on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49111
    P
    		grep on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:66314
    P
    		Security update for freerdp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73097
    P
    		grep on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:67517
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:72979
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:com.redhat.rhsa:def:20152111
    P
    		RHSA-2015:2111: grep security and bug fix update (Low)
    2015-11-19
    oval:com.redhat.rhsa:def:20151447
    P
    		RHSA-2015:1447: grep security, bug fix, and enhancement update (Low)
    2015-07-22
    oval:com.ubuntu.xenial:def:20151345000
    V
    		CVE-2015-1345 on Ubuntu 16.04 LTS (xenial) - low.
    2015-02-12
    oval:com.ubuntu.precise:def:20151345000
    V
    		CVE-2015-1345 on Ubuntu 12.04 LTS (precise) - low.
    2015-02-12
    oval:com.ubuntu.xenial:def:201513450000000
    V
    		CVE-2015-1345 on Ubuntu 16.04 LTS (xenial) - low.
    2015-02-12
    oval:com.ubuntu.trusty:def:20151345000
    V
    		CVE-2015-1345 on Ubuntu 14.04 LTS (trusty) - low.
    2015-02-12
    BACK
    gnu grep 2.19
    gnu grep 2.20
    gnu grep 2.21
    opensuse opensuse 13.2
    gnu grep 2.21
    ibm smartcloud provisioning 2.1
    ibm security network protection firmware 5.2.0
    ibm powerkvm 2.1
    ibm security network protection firmware 5.3.1
    ibm security network protection firmware 5.3.2
    ibm powerkvm 3.1