Vulnerability CVE-2015-1865

Vulnerability Name:

CVE-2015-1865 (CCN-132406)

Assigned:

2015-04-13

Published:

2015-04-13

Updated:

2017-09-27

Summary:

fts.c in coreutils 8.4 allows local users to delete arbitrary files.

CVSS v3 Severity:

4.7 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)
4.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.3 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-362

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2015-1865

Source: BID
Type: Third Party Advisory, VDB Entry
76073

Source: CCN
Type: Red Hat Bugzilla Bug 1211300
(CVE-2015-1865) CVE-2015-1865 coreutils: "time of check to time of use" race condition fts.c

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1211300

Source: XF
Type: UNKNOWN
gnucoreutils-cve20151865-sec-bypass(132406)

Source: CCN
Type: GNU Web site
GNU Coreutils

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-1865

Vulnerable Configuration:

Configuration 1:

cpe:/a:gnu:coreutils:8.4:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:gnu:coreutils:8.4:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20151865	V	CVE-2015-1865	2022-05-20
oval:org.opensuse.security:def:32197	P	Security update for glibc (Moderate)	2021-10-06
oval:org.opensuse.security:def:33013	P	Security update for gd (Moderate)	2021-09-23
oval:org.opensuse.security:def:32186	P	Security update for MozillaFirefox (Important)	2021-09-22
oval:org.opensuse.security:def:32185	P	Security update for ghostscript (Critical)	2021-09-21
oval:org.opensuse.security:def:33690	P	Security update for linuxptp (Important)	2021-07-21
oval:org.opensuse.security:def:32946	P	Security update for freeradius-server (Moderate)	2021-06-11
oval:org.opensuse.security:def:33651	P	Security update for xen (Important)	2021-05-19
oval:org.opensuse.security:def:32907	P	Security update for gdm (Important)	2021-04-28
oval:org.opensuse.security:def:28964	P	Security update for MozillaFirefox (Important)	2021-03-31
oval:org.opensuse.security:def:32969	P	Security update for python36 (Important)	2021-02-01
oval:org.opensuse.security:def:28920	P	Security update for postgresql, postgresql12, postgresql13 (Important)	2021-01-26
oval:org.opensuse.security:def:32273	P	Security update for MozillaFirefox (Important)	2021-01-12
oval:org.opensuse.security:def:28864	P	Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP2) (Important)	2020-12-07
oval:org.opensuse.security:def:28815	P	Security update for puppet	2020-12-01
oval:org.opensuse.security:def:32501	P	dbus-1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28187	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:28903	P	Security update for flash-player (Critical)	2020-12-01
oval:org.opensuse.security:def:32645	P	cups on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28383	P	Security update for rubygem-activesupport-3_2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:32858	P	fetchmail on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28525	P	Security update for wget (Moderate)	2020-12-01
oval:org.opensuse.security:def:29638	P	Security update for coreutils (Moderate)	2020-12-01
oval:org.opensuse.security:def:28761	P	Security update for libqt4	2020-12-01
oval:org.opensuse.security:def:32407	P	Security update for wget (Moderate)	2020-12-01
oval:org.opensuse.security:def:28176	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:32558	P	libnetpbm10 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28253	P	Security update for libxml2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:32801	P	unzip on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28468	P	Security update for xorg-x11-libXrender (Moderate)	2020-12-01
oval:org.opensuse.security:def:29602	P	Security update for avahi (Moderate)	2020-12-01
oval:org.opensuse.security:def:28609	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:28175	P	Security update for kernel-source (Important)	2020-12-01
oval:com.ubuntu.trusty:def:20151865000	V	CVE-2015-1865 on Ubuntu 14.04 LTS (trusty) - low.	2017-09-20
oval:com.ubuntu.precise:def:20151865000	V	CVE-2015-1865 on Ubuntu 12.04 LTS (precise) - low.	2015-04-15

BACK