CVE-2015-3400

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/04/22/4Mailing List, VDB Entry
http://www.securityfocus.com/bid/74272Third Party Advisory, VDB Entry
https://github.com/FransUrbo/zfs/commit/99aa4d2b4fd12c6bef62d02ffd1b375ddd42fcf4Patch, Third Party Advisory
https://github.com/zfsonlinux/zfs/issues/3319Third Party Advisory
https://github.com/zfsonlinux/zfs/pull/2790/commitsPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/22/4Mailing List, VDB Entry
http://www.securityfocus.com/bid/74272Third Party Advisory, VDB Entry
https://github.com/FransUrbo/zfs/commit/99aa4d2b4fd12c6bef62d02ffd1b375ddd42fcf4Patch, Third Party Advisory
https://github.com/zfsonlinux/zfs/issues/3319Third Party Advisory
https://github.com/zfsonlinux/zfs/pull/2790/commitsPatch, Third Party Advisory

Timeline

Published: Oct 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-34044.0The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass CVE-2015-34057.5ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machin CVE-2015-34067.5The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be t CVE-2015-34075.0Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the CVE-2015-340810.0Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly CVE-2015-34097.2Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under t CVE-2015-34116.5PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote a CVE-2015-34125.3PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote a CVE-2015-34147.5SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause CVE-2015-34157.5The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-depende CVE-2015-34167.5The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point co CVE-2015-34176.8Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to caus