CVE-2015-5224

Publication date 23 August 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
util-linux	15.10 wily	Not affected
	15.04 vivid	Not affected
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected

Notes

seth-arnold

wily and vivid are built with --disable-chfn-chsh which should disable the vulnerable code sections precise and trusty did not appear to have the vulnerable functions

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
util-linux	Upstream: bde91c8

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.8 · Critical

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Scores

Parameter	Value
Base score	9.8 · Critical
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Other references

https://www.cve.org/CVERecord?id=CVE-2015-5224