CVE-2015-5186
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
CVE-2015-5186- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
CVE-2015-5186- Updated
- 2026-11-02
EUVDEUVD-2015-5187 No score
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
EUVD-2015-5187- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xcgq-gmv8-4m3c
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
GHSA-xcgq-gmv8-4m3c- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
CVE-2015-5186- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5186
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
DEBIAN-CVE-2015-5186- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2015-5186
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
- Record
UBUNTU-CVE-2015-5186- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2015-0333 No score
Updated audit packages fix security vulnerability
When auditing the filesystem the names of files are logged. These filenames can contain escape sequences, when viewed using the ausearch programs "-i" option for example this can result in the escape sequences being processed unsafely by the terminal program being used to view the data (CVE-2015-5186).
- Record
MGASA-2015-0333- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10252-1 No score
audit-devel-2.5-1.82 on GA media
These are all security issues fixed in the audit-devel-2.5-1.82 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10252-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0563-1 No score
Security update for audit
This update for audit fixes the following issues:
Audit on SUSE Linux Enterprise 12 SP4 was updated to 2.8.1 to bring new features and bugfixes. (bsc#1125535 FATE#326346)
- Many features were added to auparse_normalize
- cli option added to auditd and audispd for setting config dir
- In auditd, restore the umask after creating a log file
- Option added to auditd for skipping email verification
The full changelog can be found here: http://people.redhat.com/sgrubb/audit/ChangeLog
- Change openldap dependency to client only (bsc#1085003)
Minor security issue fixed:
- CVE-2015-5186: Audit: log terminal emulator escape sequences handling (bsc#941922)
- Record
SUSE-SU-2019:0563-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1166-1 No score
Security update for audit
This update for audit fixes the following issues:
Audit on SUSE Linux Enterprise 12 SP3 was updated to 2.8.1 to bring new features and bugfixes. (bsc#1125535 FATE#326346)
- Many features were added to auparse_normalize
- cli option added to auditd and audispd for setting config dir
- In auditd, restore the umask after creating a log file
- Option added to auditd for skipping email verification
The full changelog can be found here: http://people.redhat.com/sgrubb/audit/ChangeLog
- Change openldap dependency to client only (bsc#1085003)
Minor security issue fixed:
- CVE-2015-5186: Audit: log terminal emulator escape sequences handling (bsc#941922)
- Record
SUSE-SU-2019:1166-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
auditDebian:12 |
before 1:2.4.4-1 | 1:2.4.4-1 |
auditDebian:13 |
before 1:2.4.4-1 | 1:2.4.4-1 |
auditDebian:14 |
before 1:2.4.4-1 | 1:2.4.4-1 |
auditMageia:4 |
before 2.3.2-2.5.mga4 | 2.3.2-2.5.mga4 |
auditMageia:5 |
before 2.4.4-1.mga5 | 2.4.4-1.mga5 |
auditSUSE:Linux Enterprise Desktop 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
audit-secondarySUSE:Linux Enterprise Desktop 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
auditSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
auditSUSE:Linux Enterprise Server 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
audit-secondarySUSE:Linux Enterprise Server 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
auditSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
audit-secondarySUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.8.1-10.3.2 | 2.8.1-10.3.2 |
auditSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.8.1-8.3.1 | 2.8.1-8.3.1 |
audit-secondarySUSE:Linux Enterprise Desktop 12 SP3 |
before 2.8.1-8.3.3 | 2.8.1-8.3.3 |
auditSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 2.8.1-8.3.1 | 2.8.1-8.3.1 |
auditSUSE:Linux Enterprise Server 12 SP3 |
before 2.8.1-8.3.1 | 2.8.1-8.3.1 |
audit-secondarySUSE:Linux Enterprise Server 12 SP3 |
before 2.8.1-8.3.3 | 2.8.1-8.3.3 |
auditSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.8.1-8.3.1 | 2.8.1-8.3.1 |
audit-secondarySUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.8.1-8.3.3 | 2.8.1-8.3.3 |
auditUbuntu:14.04:LTS |
All versions, plus listed versions 1:2.2.2-1ubuntu41:2.3.2-2ubuntu1 |
None known |
auditopenSUSE:Tumbleweed |
before 2.5-1.82 | 2.5-1.82 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5186 is a medium vulnerability (CVSS 5.3) in Linux Audit Project Audit, published August 30, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.76%, the 86th percentile. Fixed in audit 1:2.4.4-1.
References
securityfocus.com/bid/76840
openwall.com/lists/oss-security/2015/08/13/9
bugzilla.redhat.com/show_bug.cgi?id=1251621
people.redhat.com/sgrubb/audit/ChangeLog
nvd.nist.gov/vuln/detail/CVE-2015-5186
github.com/advisories/GHSA-xcgq-gmv8-4m3c
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2015-5186
advisories.mageia.org/MGASA-2015-0333.html
bugs.mageia.org/show_bug.cgi?id=16584
suse.com/support/update/announcement/2019/suse-su-20190563-1
bugzilla.suse.com/1042781
ubuntu.com/security/CVE-2015-5186
fedorahosted.org/audit/changeset/1122
cve.org/CVERecord?id=CVE-2015-5186