Every CVE Search/ Get API key

CVE-2015-7236

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier...

7.5 HighFix available

CVE-2015-7236 is a high vulnerability (CVSS 7.5) in Rpcbind Project Rpcbind, published September 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.41%, the 93rd percentile. Fixed in rpcbind 0.2.1-6.1.

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

6.41%Up 2.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
CVE-2015-7236
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
CVE-2015-7236
Updated
2026-11-02
EUVDEUVD-2015-7167 No score

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
EUVD-2015-7167
Updated
2026-11-03
GitHub AdvisoriesGHSA-89q3-j7mw-8c8j 7.5

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier...

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
GHSA-89q3-j7mw-8c8j
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2015-7236 7.5

CVE-2015-7236 does not affect BellSoft software

Record
BELL-CVE-2015-7236
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
CVE-2015-7236
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2015-7236 7.5

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
DEBIAN-CVE-2015-7236
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2015-7236 7.5

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Record
UBUNTU-CVE-2015-7236
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2015-0383 No score

Updated rpcbind packages fix CVE-2015-7236

Updated rpcbind package fixes security vulnerability:

A remotely triggerable use-after-free vulnerability was found in rpcbind, a server that converts RPC program numbers into universal addresses. A remote attacker can take advantage of this flaw to mount a denial of service (rpcbind crash) (CVE-2015-7236).

Record
MGASA-2015-0383
Updated
2026-11-02
OSVopenSUSE-SU-2024:10122-1 No score

rpcbind-0.2.3-7.1 on GA media

These are all security issues fixed in the rpcbind-0.2.3-7.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10122-1
Updated
2026-11-02
OSVSUSE-SU-2015:1705-1 No score

Security update for rpcbind

A use-after-free security bug in rpcbind was fixed which could lead to a remote denial of service.

Record
SUSE-SU-2015:1705-1
Updated
2026-11-02
OSVSUSE-SU-2015:1705-2 No score

Security update for rpcbind

A use-after-free security bug in rpcbind was fixed which could lead to a remote denial of service.

Record
SUSE-SU-2015:1705-2
Updated
2026-11-02
OSVSUSE-SU-2015:1706-1 No score

Security update for rpcbind

A use-after-free security bug in rpcbind was fixed which could lead to a remote denial of service.

Record
SUSE-SU-2015:1706-1
Updated
2026-11-02
OSVSUSE-SU-2015:1706-2 No score

Security update for rpcbind

A use-after-free security bug in rpcbind was fixed which could lead to a remote denial of service.

Record
SUSE-SU-2015:1706-2
Updated
2026-11-02
OSVUSN-2756-1 No score

rpcbind vulnerability

It was discovered that rpcbind incorrectly handled certain memory structures. A remote attacker could use this issue to cause rpcbind to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-2756-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpcbind
Debian:12
 before 0.2.1-6.1
0.2.1-6.1
rpcbind
Debian:13
 before 0.2.1-6.1
0.2.1-6.1
rpcbind
Debian:14
 before 0.2.1-6.1
0.2.1-6.1
rpcbind
Debian:6.0
 before 0.2.0-4.1+deb6u1, plus listed versions
0.2.0-4.1
0.2.0-4.1+deb6u1
rpcbind
Debian:7
 before 0.2.0-8+deb7u1, plus listed versions
0.2.0-8
0.2.0-8+deb7u1
rpcbind
Debian:8
 before 0.2.1-6+deb8u1, plus listed versions
0.2.1-6
0.2.1-6+deb8u1
rpcbind
Mageia:5
 before 0.2.2-1.1.mga5
0.2.2-1.1.mga5
rpcbind
Red Hat:enterprise_linux:6::client
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind
Red Hat:enterprise_linux:6::computenode
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
Show 25 moreShow less
Affected packages
PackageAffectedFixed
rpcbind-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind
Red Hat:enterprise_linux:6::server
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind
Red Hat:enterprise_linux:6::workstation
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.2.0-11.el6_7
0:0.2.0-11.el6_7
rpcbind
Red Hat:enterprise_linux:7::client
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind
Red Hat:enterprise_linux:7::computenode
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind
Red Hat:enterprise_linux:7::server
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.0-33.el7_2
0:0.2.0-33.el7_2
rpcbind
SUSE:Linux Enterprise Server 12
 before 0.2.1_rc4-13.3.1
0.2.1_rc4-13.3.1
rpcbind
SUSE:Linux Enterprise Server for SAP Applications 12
 before 0.2.1_rc4-13.3.1
0.2.1_rc4-13.3.1
rpcbind
SUSE:Linux Enterprise Desktop 12
 before 0.2.1_rc4-13.3.1
0.2.1_rc4-13.3.1
rpcbind
SUSE:Linux Enterprise Desktop 11 SP3
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
SUSE:Linux Enterprise Desktop 11 SP4
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
SUSE:Linux Enterprise Server 11 SP3
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
SUSE:Linux Enterprise Server 11 SP4
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 0.1.6+git20080930-6.24.1
0.1.6+git20080930-6.24.1
rpcbind
Ubuntu:14.04:LTS
 before 0.2.1-2ubuntu2.2, plus listed versions
0.2.0-8.2ubuntu20.2.1-2ubuntu10.2.1-2ubuntu2.1
0.2.1-2ubuntu2.2
rpcbind
openSUSE:Tumbleweed
 before 0.2.3-7.1
0.2.3-7.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open