CVE-2015-3239 Integer overflow in n/a
Local attackers can exploit an off-by-one error in libunwind via invalid dwarf opcodes, potentially causing unspecified impacts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3239?
CVE-2015-3239 is a low-severity vulnerability in n/a, published on 26 Aug 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.
Weakness: CWE-189
Which versions are affected by CVE-2015-3239?
It affects 1 product.
Linux distribution packages (16)
libunwind Red Hat:openstack:5::el6 | All versions | 0:1.1-4.1.el6ost |
libunwind-debuginfo Red Hat:openstack:5::el6 | All versions | 0:1.1-4.1.el6ost |
libunwind Red Hat:openstack:5::el7 | All versions | 0:1.1-4.1.el7ost |
libunwind-debuginfo Red Hat:openstack:5::el7 | All versions | 0:1.1-4.1.el7ost |
libunwind-devel Red Hat:openstack:5::el7 | All versions | 0:1.1-4.1.el7ost |
libunwind Red Hat:openstack:6::el7 | All versions | 0:1.1-4.1.el7ost |
libunwind-debuginfo Red Hat:openstack:6::el7 | All versions | 0:1.1-4.1.el7ost |
libunwind SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.1-11.3.1 |
libunwind SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 1.1-11.3.1 |
libunwind openSUSE:Tumbleweed | All versions | 1.2~rc1-2.3 |
Products include Libunwind Project Libunwind.
How do I fix CVE-2015-3239?
Apply the vendor's patch.
Is CVE-2015-3239 being exploited?
There is no known exploitation of CVE-2015-3239 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2015-3239, DLA-271-1, GHSA-5mwh-64pf-674p, MGASA-2015-0307, RHSA-2015:1675, RHSA-2015:1768 and 4 more.