CVE-2015-1331 Path traversal in n/a

What is CVE-2015-1331?

CVE-2015-1331 is a medium-severity path traversal vulnerability in n/a, published on 12 Aug 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.

Weakness: CWE-59

Which versions are affected by CVE-2015-1331?

It affects 1 product.

Products include Linuxcontainers Lxc.

How do I fix CVE-2015-1331?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2015-1331 being exploited?

There is no known exploitation of CVE-2015-1331 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-8649 Path traversal in LXC before 1.0.9 and 2.x before 2.0.6 Critical 9.1
• CVE-2016-10124 Privilege escalation in n/a High 8.6
• CVE-2017-18641 Supply chain in n/a High 8.1
• CVE-2013-6441 Privilege escalation in n/a High 7.2
• CVE-2015-1334 Privilege escalation in n/a Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-1331, GHSA-h6rp-phmv-c3rw, UBUNTU-CVE-2015-1331.