CVE-2015-3643 usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2.67ubuntu0.1 on Ubuntu 15.04 allows local....
HighCVSS 7.8
EPSS 1.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2.67ubuntu0.1 on Ubuntu 15.04 allows local users to gain privileges by leveraging a missing call check_polkit for the KVMTest method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| usb-creator project usb-creator | <= 0.2.38.3 | No fix listed |
| usb-creator project usb-creator | <= 0.2.56.3 | No fix listed |
| usb-creator project usb-creator | <= 0.2.62ubuntu0.2 | No fix listed |
| usb-creator project usb-creator | <= 0.2.67 | No fix listed |
References
- [oss-security] 20150422 USBCreator D-Bus service mailing-list third-party-advisory
- [oss-security] 20150504 Re: USBCreator D-Bus service mailing-list third-party-advisory
- 74304 third-party-advisory vdb-entry
- bazaar.launchpad.net third-party-advisory
- USN-2576-1 third-party-advisory vendor-advisory
- USN-2576-2 third-party-advisory vendor-advisory
- 36820 exploit third-party-advisory vdb-entry