Out-of-Bounds Affecting openafs package, versions <1.6.13-1


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-OPENAFS-1555346
  • published12 Aug 2015
  • disclosed12 Aug 2015

Introduced: 12 Aug 2015

CVE-2015-3285  (opens in a new tab)
CWE-119  (opens in a new tab)

How to fix?

Upgrade Debian:12 openafs to version 1.6.13-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openafs package and not the openafs package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service (memory corruption and kernel panic) via a crafted OSD FS command.

CVSS Scores

version 3.1