CVE-2015-4004

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.

Metrics

CVSS 2.0 8.5/10AV:N/AC:L/Au:N/C:P/I:N/A:C

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Jun 7, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-40106.8Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijCVE-2015-40165.0The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to CVE-2015-40177.5Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.CVE-2015-40186.5SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remoCVE-2015-40204.3RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API reqCVE-2015-40215.0The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that theCVE-2015-40227.5Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remotCVE-2015-40245.0Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, aCVE-2015-40257.5PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situationsCVE-2015-40267.5The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x0CVE-2015-40277.2The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges viCVE-2015-40294.3Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTM
CVE-2015-4004: High severity, CVSS 8.5 | Vulnix