VulnerabilityModified

CVE-2015-3643

usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2.67ubuntu0.1 on Ubuntu 15.04 allows local users to gain privileges by leveraging a missing call…

HIGH 7.8EPSS 1.53%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.53% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: usb-creator project/usb-creator
Source: cve@mitre.org

References

http://www.openwall.com/lists/oss-security/2015/04/22/12Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/04/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74304Third Party Advisory, VDB Entry
https://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470Third Party Advisory
https://usn.ubuntu.com/usn/usn-2576-1/Third Party Advisory
https://usn.ubuntu.com/usn/usn-2576-2/Third Party Advisory
https://www.exploit-db.com/exploits/36820/Exploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/04/22/12Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/04/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74304Third Party Advisory, VDB Entry
https://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470Third Party Advisory
https://usn.ubuntu.com/usn/usn-2576-1/Third Party Advisory
https://usn.ubuntu.com/usn/usn-2576-2/Third Party Advisory
https://www.exploit-db.com/exploits/36820/Exploit, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.