CVE-2015-5200
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application,...
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
CVE-2015-5200- CVSS 2.0
- 6.3 Medium
AV:L/AC:M/Au:N/C:N/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
CVE-2015-5200- Updated
- 2026-11-02
EUVDEUVD-2015-5201 No score
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
EUVD-2015-5201- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3qwj-pv6x-95j3 No score
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application,...
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
GHSA-3qwj-pv6x-95j3- Updated
- 2026-11-02
OSV No score
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
CVE-2015-5200- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5200 No score
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
DEBIAN-CVE-2015-5200- Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2015-0364 No score
Updated libvdpau packages fix security vulnerabilities
Updated libvdpau packages fix security vulnerabilities:
libvdpau versions 1.1 and earlier, when used in setuid or setgid applications, contain vulnerabilities related to environment variable handling that could allow an attacker to execute arbitrary code or overwrite arbitrary files (CVE-2015-5198, CVE-2015-5199, and CVE-2015-5200).
- Record
MGASA-2015-0364- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10224-1 No score
libvdpau-devel-1.1.1-1.7 on GA media
These are all security issues fixed in the libvdpau-devel-1.1.1-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10224-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1892-1 No score
Security update for libvdpau
libvdpau was updated to use secure_getenv() instead of getenv() for several variables so it can be more safely used in setuid applications.
- CVE-2015-5198: libvdpau: incorrect check for security transition (bnc#943967)
- CVE-2015-5199: libvdpau: directory traversal in dlopen (bnc#943968)
- CVE-2015-5200: libvdpau: vulnerability in trace functionality (bnc#943969)
- Record
SUSE-SU-2015:1892-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1925-1 No score
Security update for libvdpau
libvdpau was updated to use secure_getenv() instead of getenv() for several variables so it can be more safely used in setuid applications.
- CVE-2015-5198: libvdpau: incorrect check for security transition (bnc#943967)
- CVE-2015-5199: libvdpau: directory traversal in dlopen (bnc#943968)
- CVE-2015-5200: libvdpau: vulnerability in trace functionality (bnc#943969)
- Record
SUSE-SU-2015:1925-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5200 No score
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
- Record
UBUNTU-CVE-2015-5200- Updated
- 2026-11-02
OSVUSN-2729-1 No score
libvdpau vulnerabilities
Florian Weimer discovered that libvdpau incorrectly handled certain environment variables. A local attacker could possibly use this issue to gain privileges.
- Record
USN-2729-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libvdpauDebian:12 |
before 1.1.1-1 | 1.1.1-1 |
libvdpauDebian:13 |
before 1.1.1-1 | 1.1.1-1 |
libvdpauDebian:14 |
before 1.1.1-1 | 1.1.1-1 |
libvdpauDebian:6.0 From an advisory covering 3 CVEs |
before 0.4.1-2+deb6u1, plus listed versions 0.4.1-2 |
0.4.1-2+deb6u1 |
libvdpauDebian:7 From an advisory covering 3 CVEs |
before 0.4.1-7+deb7u1, plus listed versions 0.4.1-7 |
0.4.1-7+deb7u1 |
libvdpauDebian:8 From an advisory covering 3 CVEs |
before 0.8-3+deb8u1, plus listed versions 0.8-3 |
0.8-3+deb8u1 |
libvdpauMageia:4 From an advisory covering 3 CVEs |
before 1.1.1-1.mga4 | 1.1.1-1.mga4 |
libvdpauMageia:5 From an advisory covering 3 CVEs |
before 1.1.1-1.mga5 | 1.1.1-1.mga5 |
libvdpauSUSE:Linux Enterprise Desktop 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libvdpauSUSE:Linux Enterprise Server 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 3 CVEs |
before 0.8-3.1 | 0.8-3.1 |
libvdpauSUSE:Linux Enterprise Desktop 11 SP3 From an advisory covering 3 CVEs |
before 0.4.1-16.20.2 | 0.4.1-16.20.2 |
libvdpauSUSE:Linux Enterprise Desktop 11 SP4 From an advisory covering 3 CVEs |
before 0.4.1-16.20.2 | 0.4.1-16.20.2 |
libvdpauUbuntu:14.04:LTS |
before 0.7-1ubuntu0.1, plus listed versions 0.7-1 |
0.7-1ubuntu0.1 |
libvdpauUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 0.7-1ubuntu0.1, plus listed versions 0.7-1 |
0.7-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5200 is a medium vulnerability (CVSS 6.3) in Libvdpau Project Libvdpau, published September 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in libvdpau 1.1.1-1.
References
lists.fedoraproject.org/pipermail/package-announce/2015-September/167469.html
bugzilla.redhat.com/show_bug.cgi?id=1253827
securityfocus.com/bid/76636
ubuntu.com/usn/USN-2729-1
Show 21 moreShow less
lists.opensuse.org/opensuse-updates/2015-09/msg00012.html
lists.x.org/archives/xorg-announce/2015-August/002630.html
debian.org/security/2015/dsa-3355
nvd.nist.gov/vuln/detail/CVE-2015-5200
github.com/advisories/GHSA-3qwj-pv6x-95j3
security-tracker.debian.org/tracker/CVE-2015-5200
advisories.mageia.org/MGASA-2015-0364.html
bugs.mageia.org/show_bug.cgi?id=16687
suse.com/support/update/announcement/2015/suse-su-20151892-1
bugzilla.suse.com/943967
ubuntu.com/security/CVE-2015-5200
cve.org/CVERecord?id=CVE-2015-5200