CVE-2015-5198
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain...
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
Exploit likelihood
What each source reports
NVD Score used
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
CVE-2015-5198- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
CVE-2015-5198- Updated
- 2026-11-02
EUVDEUVD-2015-5199 No score
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
EUVD-2015-5199- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-354j-fr8h-qqfv No score
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain...
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
GHSA-354j-fr8h-qqfv- Updated
- 2026-11-02
OSV No score
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
CVE-2015-5198- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5198 No score
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
DEBIAN-CVE-2015-5198- Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2015-0364 No score
Updated libvdpau packages fix security vulnerabilities
Updated libvdpau packages fix security vulnerabilities:
libvdpau versions 1.1 and earlier, when used in setuid or setgid applications, contain vulnerabilities related to environment variable handling that could allow an attacker to execute arbitrary code or overwrite arbitrary files (CVE-2015-5198, CVE-2015-5199, and CVE-2015-5200).
- Record
MGASA-2015-0364- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10224-1 No score
libvdpau-devel-1.1.1-1.7 on GA media
These are all security issues fixed in the libvdpau-devel-1.1.1-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10224-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1892-1 No score
Security update for libvdpau
libvdpau was updated to use secure_getenv() instead of getenv() for several variables so it can be more safely used in setuid applications.
- CVE-2015-5198: libvdpau: incorrect check for security transition (bnc#943967)
- CVE-2015-5199: libvdpau: directory traversal in dlopen (bnc#943968)
- CVE-2015-5200: libvdpau: vulnerability in trace functionality (bnc#943969)
- Record
SUSE-SU-2015:1892-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1925-1 No score
Security update for libvdpau
libvdpau was updated to use secure_getenv() instead of getenv() for several variables so it can be more safely used in setuid applications.
- CVE-2015-5198: libvdpau: incorrect check for security transition (bnc#943967)
- CVE-2015-5199: libvdpau: directory traversal in dlopen (bnc#943968)
- CVE-2015-5200: libvdpau: vulnerability in trace functionality (bnc#943969)
- Record
SUSE-SU-2015:1925-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5198 No score
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
- Record
UBUNTU-CVE-2015-5198- Updated
- 2026-11-02
OSVUSN-2729-1 No score
libvdpau vulnerabilities
Florian Weimer discovered that libvdpau incorrectly handled certain environment variables. A local attacker could possibly use this issue to gain privileges.
- Record
USN-2729-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libvdpauDebian:12 |
before 1.1.1-1 | 1.1.1-1 |
libvdpauDebian:13 |
before 1.1.1-1 | 1.1.1-1 |
libvdpauDebian:14 |
before 1.1.1-1 | 1.1.1-1 |
libvdpauDebian:6.0 From an advisory covering 3 CVEs |
before 0.4.1-2+deb6u1, plus listed versions 0.4.1-2 |
0.4.1-2+deb6u1 |
libvdpauDebian:7 From an advisory covering 3 CVEs |
before 0.4.1-7+deb7u1, plus listed versions 0.4.1-7 |
0.4.1-7+deb7u1 |
libvdpauDebian:8 From an advisory covering 3 CVEs |
before 0.8-3+deb8u1, plus listed versions 0.8-3 |
0.8-3+deb8u1 |
libvdpauMageia:4 From an advisory covering 3 CVEs |
before 1.1.1-1.mga4 | 1.1.1-1.mga4 |
libvdpauMageia:5 From an advisory covering 3 CVEs |
before 1.1.1-1.mga5 | 1.1.1-1.mga5 |
libvdpauSUSE:Linux Enterprise Desktop 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libvdpauSUSE:Linux Enterprise Server 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Desktop 11 SP3 From an advisory covering 3 CVEs |
before 0.4.1-16.20.2 | 0.4.1-16.20.2 |
libvdpauSUSE:Linux Enterprise Desktop 11 SP4 From an advisory covering 3 CVEs |
before 0.4.1-16.20.2 | 0.4.1-16.20.2 |
libvdpauUbuntu:14.04:LTS |
before 0.7-1ubuntu0.1, plus listed versions 0.7-1 |
0.7-1ubuntu0.1 |
libvdpauUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 0.7-1ubuntu0.1, plus listed versions 0.7-1 |
0.7-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5198 is a high vulnerability (CVSS 7.2) in Libvdpau Project Libvdpau, published September 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in libvdpau 1.1.1-1.
References
lists.fedoraproject.org/pipermail/package-announce/2015-September/167469.html
securityfocus.com/bid/76636
bugzilla.redhat.com/show_bug.cgi?id=1253824
ubuntu.com/usn/USN-2729-1
Show 21 moreShow less
lists.opensuse.org/opensuse-updates/2015-09/msg00012.html
lists.x.org/archives/xorg-announce/2015-August/002630.html
debian.org/security/2015/dsa-3355
nvd.nist.gov/vuln/detail/CVE-2015-5198
github.com/advisories/GHSA-354j-fr8h-qqfv
security-tracker.debian.org/tracker/CVE-2015-5198
advisories.mageia.org/MGASA-2015-0364.html
bugs.mageia.org/show_bug.cgi?id=16687
suse.com/support/update/announcement/2015/suse-su-20151892-1
bugzilla.suse.com/943967
ubuntu.com/security/CVE-2015-5198
cve.org/CVERecord?id=CVE-2015-5198