CVE-2015-8768 click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges....
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| click project click | All versions | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
References
- bazaar.launchpad.net
- USN-2771-1 third-party-advisory vendor-advisory
- [oss-security] 20160112 Re: CVE Request: click mailing-list patch third-party-advisory
- 96386 third-party-advisory vdb-entry
- bugs.launchpad.net issue-tracking patch third-party-advisory
- code.launchpad.net issue-tracking patch third-party-advisory
- insights.ubuntu.com
- plus.google.com