VulnerabilityModified

CVE-2015-1783

The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial of service (uninitialized memory access and application crash) via unspecified vectors.

HIGH 7.5EPSS 3.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 3.45% probability · 88th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: fedoraproject/fedora · entrouvert/lasso
Source: secalert@redhat.com

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154321.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154355.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155382.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1199925Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://repos.entrouvert.org/lasso.git/commit/lasso/xml?id=6d854cef4211cdcdbc7446c978f23ab859847cddPatch, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154321.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154355.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155382.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1199925Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://repos.entrouvert.org/lasso.git/commit/lasso/xml?id=6d854cef4211cdcdbc7446c978f23ab859847cddPatch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.