CVE-2017-15288 High severity vulnerability that affects org.scala-lang:scala-compiler
HighCVSS 7.8
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.scala-lang/scala-compiler(Maven) | < 2.10.7 | 2.10.7 |
| org.scala-lang/scala-compiler(Maven) | >= 2.11.0, < 2.11.12 | 2.11.12 |
| org.scala-lang/scala-compiler(Maven) | >= 2.12.0, < 2.12.4 | 2.12.4 |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M1-virtualized | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M1-virtualized.rdev-4217-2012-01-24-g9118644 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-M7 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-RC4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.0-RC5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.1-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.1-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.1-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.2-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.2-RC2 | No fix listed |
Show 119 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.scala-lang/scala-compiler(Maven) | = 2.10.3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.3-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.3-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.3-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.4-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.4-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.4-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.10.6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.3.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.3.3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.4.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.4.0-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.4.0-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.5.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.5.0-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.5.0-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.5.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.6.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.6.0-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.6.0-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.6.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.6.1-rc1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.6.1-rc2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.0-rc1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.0-rc2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.0-rc3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.1-rc1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.1-rc2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.2-rc1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.2-rc2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.2-rc3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.2-rc6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.3.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.3.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.4.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.4.final | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.7 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.7.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.7.7.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC7 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.Beta1-RC8 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.RC7 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.0.r18462-b20090811081019 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.1.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.1.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.1.RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.1.RC4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.2.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.2.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.8.2.RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0-1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0.RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0.RC4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.0.RC5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1-1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1-1-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1.RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1.RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1.RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.1.RC4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.2-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.2-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.2-RC3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.3-RC1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.9.3-RC2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.10 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.11 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.3 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.4 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.5 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.6 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.7 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.8 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.8-18269ea | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.11.9 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.12.0 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.12.1 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.12.2 | No fix listed |
| org.scala-lang/scala-compiler(Maven) | = 2.12.3 | No fix listed |
| debian/scala(Debian:12) | < 2.11.12-1 | 2.11.12-1 |
| debian/scala(Debian:13) | < 2.11.12-1 | 2.11.12-1 |
| debian/scala(Debian:14) | < 2.11.12-1 | 2.11.12-1 |
| scala-lang scala | < 2.10.7 | 2.10.7 |
| scala-lang scala | >= 2.11.0, < 2.11.12 | 2.11.12 |
| scala-lang scala | >= 2.12.0, < 2.12.4 | 2.12.4 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- GLSA-201812-08 third-party-advisory vendor-advisory
- scala-lang.org issue-tracking mitigation vendor-advisory
- github.com product
- Debian Security Tracker CVE-2017-15288 vendor-advisory
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [kafka-jira] 20210214 [jira] [Commented] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? mailing-list
- [kafka-jira] 20210212 [jira] [Commented] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? mailing-list
- [druid-commits] 20210302 [GitHub] [druid] maytasm merged pull request #10933: Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15on mailing-list
- [druid-commits] 20210302 [GitHub] [druid] abhishekagarwal87 opened a new pull request #10933: Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15on mailing-list
- [kafka-jira] 20210211 [jira] [Updated] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? mailing-list
- [kafka-jira] 20210215 [jira] [Commented] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? mailing-list
- [kafka-dev] 20210215 [jira] [Resolved] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? mailing-list
- [kafka-dev] 20210211 [jira] [Created] (KAFKA-12325) Update to secure versions of scala libraries due to CVE-2017-15288 mailing-list
- [kafka-jira] 20210211 [jira] [Created] (KAFKA-12325) Update to secure versions of scala libraries due to CVE-2017-15288 mailing-list
- [kafka-jira] 20210215 [jira] [Resolved] (KAFKA-12325) Is Kafka affected by Scala security vulnerability (CVE-2017-15288)? mailing-list