CVE-2015-0278

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent...

10.0 HighFix available

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

Exploit likelihood

3.24%Up 2.1 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

Record: CVE-2015-0278
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-273
Updated: 2026-11-02

CVE List No score

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

Record: CVE-2015-0278
Updated: 2026-11-02

EUVDEUVD-2015-0291 No score

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

Record: EUVD-2015-0291
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hmvq-6hjm-q8hj No score

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent...

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

Record: GHSA-hmvq-6hjm-q8hj
Weakness: CWE-273
Updated: 2026-11-02

OSVMGASA-2015-0186 No score

Updated nodejs packages fix security vulnerabilities

Updated nodejs package fixes security vulnerability:

It was found that libuv does not call setgoups before calling setuid/setgid. This may potentially allow an attacker to gain elevated privileges (CVE-2015-0278).

The libuv library is bundled with nodejs, and a fixed version of libuv is included with nodejs as of version 0.10.37. The nodejs package has been updated to version 0.10.38 to fix this issue, as well as several other bugs.

Record: MGASA-2015-0186
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nodejs` Mageia:4	before 0.10.38-1.mga4	0.10.38-1.mga4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0278 is a high vulnerability (CVSS 10.0) in Libuv Project Libuv, published May 5, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.24%, the 88th percentile. Fixed in nodejs 0.10.38-1.mga4.

References

Show 9 moreShow less