CVE-2015-1336
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows...
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
CVE-2015-1336- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
CVE-2015-1336- Updated
- 2026-11-02
EUVDEUVD-2015-1476 No score
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
EUVD-2015-1476- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v8g2-q7cg-qvg6
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows...
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
GHSA-v8g2-q7cg-qvg6- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
CVE-2015-1336- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1336
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
DEBIAN-CVE-2015-1336- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1336
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
- Record
UBUNTU-CVE-2015-1336- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-5334-1 No score
man-db vulnerability
It was discovered that man-db incorrectly handled permission changing operations in its daily cron job, and was therefore affected by a race condition. An attacker could possibly use this issue to escalate privileges and execute arbitrary code.
- Record
USN-5334-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
man-dbDebian:12 |
before 2.7.6-1 | 2.7.6-1 |
man-dbDebian:13 |
before 2.7.6-1 | 2.7.6-1 |
man-dbDebian:14 |
before 2.7.6-1 | 2.7.6-1 |
man-dbUbuntu:14.04:LTS |
All versions, plus listed versions 2.6.5-22.6.5-32.6.6-12.6.7.1-12.6.7.1-1ubuntu1 |
None known |
man-dbUbuntu:Pro:16.04:LTS |
before 2.7.5-1ubuntu0.1~esm1, plus listed versions 2.7.4-12.7.5-1 |
2.7.5-1ubuntu0.1~esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Man-db 2.6.7.1 - Local Privilege Escalation | 2015-12-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1336 is a high vulnerability (CVSS 7.8) in Man-db Project Man-db, published September 27, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in man-db 2.7.6-1.
References
bugs.launchpad.net/ubuntu/+source/man-db/+bug/1482786
packetstormsecurity.com/files/140759/Man-db-2.6.7.1-Privilege-Escalation.html
halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation
people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1336.html
securityfocus.com/bid/79723
security.gentoo.org/glsa/201707-12
Show 9 moreShow less
openwall.com/lists/oss-security/2015/12/14/11
bugs.debian.org/cgi-bin/bugreport.cgi?bug=840357
nvd.nist.gov/vuln/detail/CVE-2015-1336
github.com/advisories/GHSA-v8g2-q7cg-qvg6
security-tracker.debian.org/tracker/CVE-2015-1336
ubuntu.com/security/CVE-2015-1336
lists.nongnu.org/archive/html/man-db-announce/2016-12/msg00000.html
cve.org/CVERecord?id=CVE-2015-1336