CVE-2015-3282

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack...

4.3 MediumFix available

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Exploit likelihood

1.88%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: CVE-2015-3282
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: CVE-2015-3282
Updated: 2026-11-02

EUVDEUVD-2015-3329 No score

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: EUVD-2015-3329
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2j3g-mmqf-22pf No score

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack...

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: GHSA-2j3g-mmqf-22pf
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: CVE-2015-3282
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-3282 No score

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: DEBIAN-CVE-2015-3282
Updated: 2026-11-02

OSVMGASA-2015-0337 No score

Updated openafs package fixes security vulnerabilities

Updated openafs packages fix security vulnerabilities:

Memory allocated by vos for VLDB entry structures was not cleared prior to use, meaning stack data could be sent over the network, possibly in the clear if crypt mode was not in use (CVE-2015-3282).

The default use by bos of clear rather than crypt mode can allow spoofing commands, including some which modify server state if restricted mode was not enabled (CVE-2015-3283).

A local user executing commands which make pioctl calls to the kernel will have some contents of kernel memory leaked when buffers used are larger than data being returned (CVE-2015-3284).

A local user executing the OSD FS command pioctl can trigger a panic due to an incorrect buffer being used for return status of the command (CVE-2015-3285).

The vlserver allows pattern matching on volume names via regular expressions when listing attributes. Because the regular expression is not checked for situations which can overflow the buffers used, an attack is possible which reads arbitrary memory beyond the end of the buffer and can act on it as part of the expression evaluation, potentially crashing the process (CVE-2015-6587).

Record: MGASA-2015-0337
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-3282 No score

vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.

Record: UBUNTU-CVE-2015-3282
Updated: 2026-11-02

Affected products

openafs

Affected packages

Affected packages
Package	Affected	Fixed
`openafs` Debian:12	before 1.6.13-1	1.6.13-1
`openafs` Debian:13	before 1.6.13-1	1.6.13-1
`openafs` Debian:6.0	before 1.4.12.1+dfsg-4+squeeze4, plus listed versions 1.4.12.1+dfsg-31.4.12.1+dfsg-41.4.12.1+dfsg-4+squeeze11.4.12.1+dfsg-4+squeeze21.4.12.1+dfsg-4+squeeze31.4.12.1+dfsg-4~bpo50+1	1.4.12.1+dfsg-4+squeeze4
`openafs` Debian:7	before 1.6.1-3+deb7u3, plus listed versions 1.6.1-31.6.1-3+deb7u11.6.1-3+deb7u1~bpo60+11.6.1-3+deb7u21.6.1-3+deb7u2~bpo60+1	1.6.1-3+deb7u3
`openafs` Debian:8	before 1.6.9-2+deb8u3, plus listed versions 1.6.9-2+deb8u2	1.6.9-2+deb8u3
`openafs` Mageia:4	before 1.6.13-1.mga4	1.6.13-1.mga4
`openafs` Mageia:5	before 1.6.13-1.mga5	1.6.13-1.mga5
`openafs` Ubuntu:14.04:LTS	before 1.6.7-1ubuntu1.1, plus listed versions 1.6.5-1ubuntu31.6.5.1-11.6.5.1-1ubuntu11.6.6~pre2-11.6.6-11.6.7-11.6.7-1ubuntu1	1.6.7-1ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-3282 is a medium vulnerability (CVSS 4.3) in Openafs, published July 30, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in openafs 1.6.13-1.

References

Show 12 moreShow less