CVE-2015-1336 Privilege escalation in n/a
Local attackers with man account access can escalate privileges due to insecure chown usage in the daily cleanup job.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1336?
CVE-2015-1336 is a high-severity vulnerability in n/a, published on 27 Sep 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Weakness: CWE-284
Which versions are affected by CVE-2015-1336?
It affects 1 product.
Products include Man-Db Project Man-Db.
How do I fix CVE-2015-1336?
Apply the vendor's patch.
Is CVE-2015-1336 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-1336 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2015-1336, GHSA-v8g2-q7cg-qvg6, UBUNTU-CVE-2015-1336, USN-5334-1.