CVE-2015-0794

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2...

3.6 LowFix available

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.

Exploit likelihood

0.35%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.

Record: CVE-2015-0794
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.

Record: CVE-2015-0794
Updated: 2026-11-02

EUVDEUVD-2015-0807 No score

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.

Record: EUVD-2015-0807
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j973-4x87-2j5r No score

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2...

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.

Record: GHSA-j973-4x87-2j5r
Weakness: CWE-59
Updated: 2026-11-02

OSVSUSE-SU-2015:2065-1 No score

Security update for dracut

The dracut package was updated to fix the following security and non-security issues:

CVE-2015-0794: Use mktemp instead of hardcoded filenames, possible vulnerability (bsc#935338).
Always install mdraid modules (bsc#935993).
Add notice when dracut failed to install modules (bsc#952491).
Always install dm-snaphost module if lvm dracut module is needed, even if dm-snapshot is not loaded on the host yet (bsc#947518).

Record: SUSE-SU-2015:2065-1
Updated: 2026-11-02

Affected products

dracut project dracut

Affected packages

Affected packages
Package	Affected	Fixed
`dracut` SUSE:Linux Enterprise Desktop 12	before 037-51.17.3	037-51.17.3
`dracut` SUSE:Linux Enterprise Server 12	before 037-51.17.3	037-51.17.3
`dracut` SUSE:Linux Enterprise Server for SAP Applications 12	before 037-51.17.3	037-51.17.3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0794 is a low vulnerability (CVSS 3.6) in Dracut Project Dracut, published November 19, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in dracut 037-51.17.3.

References

Show 5 moreShow less