CVE-2015-4156 Path traversal in n/a
Local attackers can write to arbitrary files via symlink attacks when using specific GNU Parallel options, requiring local access and specific command flags.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4156?
CVE-2015-4156 is a low-severity path traversal vulnerability in Opensuse Opensuse, published on 2 Jun 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Weakness: CWE-59
Which versions are affected by CVE-2015-4156?
It affects 2 products.
Products include Gnu Parallel, Opensuse Opensuse.
How do I fix CVE-2015-4156?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-4156 being exploited?
There is no known exploitation of CVE-2015-4156 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2015-4156, GHSA-c272-w43g-64p3, UBUNTU-CVE-2015-4156.