CVE-2015-7763

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2015/dsa-3387
http://www.securitytracker.com/id/1034039
https://lists.openafs.org/pipermail/openafs-announce/2015/000493.htmlVendor Advisory
https://www.openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15Vendor Advisory
https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txtVendor Advisory
http://www.debian.org/security/2015/dsa-3387
http://www.securitytracker.com/id/1034039
https://lists.openafs.org/pipermail/openafs-announce/2015/000493.htmlVendor Advisory
https://www.openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15Vendor Advisory
https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txtVendor Advisory

Timeline

Published: Nov 6, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-77647.5Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.CVE-2015-77659.0ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows CVE-2015-77669.0PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions vi CVE-2015-77677.5Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of service (applicatio CVE-2015-77687.5Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.CVE-2015-77696.3baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.CVE-2015-77705.0Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted CVE-2015-77714.3Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows CVE-2015-77724.3Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows CVE-2015-77736.5Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to ex CVE-2015-77746.5PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by levera CVE-2015-77755.4Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via