CVE-2015-5232

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/09/22/17Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1257098Issue Tracking, Third Party Advisory
https://github.com/01org/opa-ff/commit/080ab97461d80a01636f77ba6aecc667c3c0087cPatch
https://github.com/01org/opa-fm/commit/5f4087aabb5d03c42738b320af0fc60e9df4d1f7Patch
https://github.com/01org/opa-fm/commit/c5759e7b76f5bf844be6c6641cc1b356bbc83869Patch
http://www.openwall.com/lists/oss-security/2015/09/22/17Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1257098Issue Tracking, Third Party Advisory
https://github.com/01org/opa-ff/commit/080ab97461d80a01636f77ba6aecc667c3c0087cPatch
https://github.com/01org/opa-fm/commit/5f4087aabb5d03c42738b320af0fc60e9df4d1f7Patch
https://github.com/01org/opa-fm/commit/c5759e7b76f5bf844be6c6641cc1b356bbc83869Patch

Timeline

Published: Jun 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-52334.2Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with t CVE-2015-52346.8IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into CVE-2015-52354.3IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to CVE-2015-52367.5It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origi CVE-2015-52378.8protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.CVE-2015-52396.5Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_C CVE-2015-52403.5Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, a CVE-2015-52416.1After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to CVE-2015-52426.0OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows rem CVE-2015-52439.8phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.CVE-2015-52449.8The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.CVE-2015-52454.3CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitra