CVE-2015-8026 - Vulnerability Details - OpenCVE

Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Exfat Project	Exfat

Configuration 1 [-]

cpe:2.3:a:exfat_project:exfat:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2015/10/29/13
http://www.securityfocus.com/bid/77307
https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html
https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786
https://github.com/relan/exfat/issues/5
https://security.gentoo.org/glsa/201612-31

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-03-27T15:00:00

Updated: 2024-08-06T08:06:31.639Z

Reserved: 2015-10-29T00:00:00

Link: CVE-2015-8026

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-03-27T15:59:00.170

Modified: 2025-04-20T01:37:25.860

Link: CVE-2015-8026

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-10-24T00:00:00", "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-03-27T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786"}, {"name": "GLSA-201612-31", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-31"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/relan/exfat/issues/5"}, {"name": "77307", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/77307"}, {"name": "[oss-security] 20151029 Re: Heap overflow and endless loop in exfatfsck / exfat-utils", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/10/29/13"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2015-8026", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786", "refsource": "CONFIRM", "url": "https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786"}, {"name": "GLSA-201612-31", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-31"}, {"name": "https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html", "refsource": "MISC", "url": "https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html"}, {"name": "https://github.com/relan/exfat/issues/5", "refsource": "CONFIRM", "url": "https://github.com/relan/exfat/issues/5"}, {"name": "77307", "refsource": "BID", "url": "http://www.securityfocus.com/bid/77307"}, {"name": "[oss-security] 20151029 Re: Heap overflow and endless loop in exfatfsck / exfat-utils", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/10/29/13"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:06:31.639Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786"}, {"name": "GLSA-201612-31", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-31"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/relan/exfat/issues/5"}, {"name": "77307", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/77307"}, {"name": "[oss-security] 20151029 Re: Heap overflow and endless loop in exfatfsck / exfat-utils", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/10/29/13"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8026", "datePublished": "2017-03-27T15:00:00", "dateReserved": "2015-10-29T00:00:00", "dateUpdated": "2024-08-06T08:06:31.639Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:exfat_project:exfat:*:*:*:*:*:*:*:*", "matchCriteriaId": "96104A66-4DF9-4D68-BB4D-F542C13360FD", "versionEndIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en la funci\u00f3n verify_vbr_checksum en exfatfsck en exfat-utils en versiones anteriores a 1.2.1 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (bucle infinito) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de un sistema de archivos manipulado."}], "id": "CVE-2015-8026", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2017-03-27T15:59:00.170", "references": [{"source": "[email protected]", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2015/10/29/13"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/77307"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/relan/exfat/issues/5"}, {"source": "[email protected]", "tags": ["Patch", "Third Party Advisory", "VDB Entry"], "url": "https://security.gentoo.org/glsa/201612-31"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2015/10/29/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/77307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://blog.fuzzing-project.org/25-Heap-overflow-and-endless-loop-in-exfatfsck-exfat-utils.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/relan/exfat/commit/2e86ae5f81da11f11673d0546efb525af02b7786"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/relan/exfat/issues/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory", "VDB Entry"], "url": "https://security.gentoo.org/glsa/201612-31"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "[email protected]", "type": "Primary"}]}