CVE-2015-8026

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/10/29/13Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/77307Third Party Advisory, VDB Entry
https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.htmlThird Party Advisory
https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786Issue Tracking, Patch, Third Party Advisory
https://github.com/relan/exfat/issues/5Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201612-31Patch, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/10/29/13Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/77307Third Party Advisory, VDB Entry
https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.htmlThird Party Advisory
https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786Issue Tracking, Patch, Third Party Advisory
https://github.com/relan/exfat/issues/5Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201612-31Patch, Third Party Advisory, VDB Entry

Timeline

Published: Mar 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-80277.5Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, whic CVE-2015-80286.8Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or CVE-2015-80296.8SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted Filmbox document, which triggers memor CVE-2015-80306.8SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D, (2) LWO, (3) JPEG2000, or (4)CVE-2015-80319.8Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.CVE-2015-80325.3In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.CVE-2015-80335.3In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.CVE-2015-80343.3The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive informa CVE-2015-80352.6The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to CVE-2015-80366.8Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a CVE-2015-80374.3Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote CVE-2015-80384.3Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote