CVE-2015-7763
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not...
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
Exploit likelihood
What each source reports
NVD Score used
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
CVE-2015-7763- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
CVE-2015-7763- Updated
- 2026-11-02
EUVDEUVD-2015-7663 No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
EUVD-2015-7663- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jfjc-3x9j-qg99 No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not...
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
GHSA-jfjc-3x9j-qg99- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
CVE-2015-7763- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7763 No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
DEBIAN-CVE-2015-7763- Updated
- 2026-11-02
OSVMGASA-2015-0424 No score
Updated openafs packages fix security vulnerabilities
Updated openafs packages fix security vulnerabilities:
When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx implementations do not initialize three octets of data that are padding in the C language structure and were inadvertently included in the wire protocol (CVE-2015-7762).
Additionally, OpenAFS Rx before version 1.6.14 includes a variable-length padding at the end of the ACK packet, in an attempt to detect the path MTU, but only four octets of the additional padding are initialized (CVE-2015-7763).
- Record
MGASA-2015-0424- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7763 No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
UBUNTU-CVE-2015-7763- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsDebian:12 |
before 1.6.15-1 | 1.6.15-1 |
openafsDebian:13 |
before 1.6.15-1 | 1.6.15-1 |
openafsDebian:6.0 |
before 1.4.12.1+dfsg-4+squeeze4, plus listed versions 1.4.12.1+dfsg-31.4.12.1+dfsg-41.4.12.1+dfsg-4+squeeze11.4.12.1+dfsg-4+squeeze21.4.12.1+dfsg-4+squeeze31.4.12.1+dfsg-4~bpo50+1 |
1.4.12.1+dfsg-4+squeeze4 |
openafsDebian:7 |
before 1.6.1-3+deb7u5, plus listed versions 1.6.1-31.6.1-3+deb7u11.6.1-3+deb7u1~bpo60+11.6.1-3+deb7u21.6.1-3+deb7u2~bpo60+11.6.1-3+deb7u31.6.1-3+deb7u4 |
1.6.1-3+deb7u5 |
openafsDebian:8 |
before 1.6.9-2+deb8u4, plus listed versions 1.6.9-2+deb8u21.6.9-2+deb8u31.6.9-2+deb8u4~bpo70+1 |
1.6.9-2+deb8u4 |
openafsMageia:5 |
before 1.6.15-1.mga5 | 1.6.15-1.mga5 |
openafsUbuntu:14.04:LTS |
before 1.6.7-1ubuntu1.1, plus listed versions 1.6.5-1ubuntu31.6.5.1-11.6.5.1-1ubuntu11.6.6~pre2-11.6.6-11.6.7-11.6.7-1ubuntu1 |
1.6.7-1ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7763 is a medium vulnerability (CVSS 5.0) in Openafs, published November 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in openafs 1.6.15-1.
References
openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15
lists.openafs.org/pipermail/openafs-announce/2015/000493.html
securitytracker.com/id/1034039
debian.org/security/2015/dsa-3387
nvd.nist.gov/vuln/detail/CVE-2015-7763
Show 9 moreShow less
github.com/advisories/GHSA-jfjc-3x9j-qg99
security-tracker.debian.org/tracker/CVE-2015-7763
advisories.mageia.org/MGASA-2015-0424.html
bugs.mageia.org/show_bug.cgi?id=17050
openafs.org/dl/openafs/1.6.14/RELNOTES-1.6.14
ubuntu.com/security/CVE-2015-7763
cve.org/CVERecord?id=CVE-2015-7763