CVE-2015-5186

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/08/13/9Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/76840Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1251621Issue Tracking, Third Party Advisory
https://people.redhat.com/sgrubb/audit/ChangeLogRelease Notes, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/08/13/9Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/76840Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1251621Issue Tracking, Third Party Advisory
https://people.redhat.com/sgrubb/audit/ChangeLogRelease Notes, Third Party Advisory

Timeline

Published: Sep 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-51876.5Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffi CVE-2015-51886.8Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and CVE-2015-51894.9Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to g CVE-2015-51908.5The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.CVE-2015-51916.7VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Success CVE-2015-51947.5The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd cr CVE-2015-51957.5ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted stati CVE-2015-51987.2libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related t CVE-2015-51997.2Directory traversal vulnerability in dlopen in libvdpau before 1.1.1 allows local users to gain privileges via the VDPAU_DRIVER environment CVE-2015-52006.3The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary file CVE-2015-52017.5VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.CVE-2015-52035.5Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (cr