CVE-2015-0858
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a...
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
CVE-2015-0858- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
CVE-2015-0858- Updated
- 2026-11-02
EUVDEUVD-2015-0869 No score
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
EUVD-2015-0869- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h989-3vfv-vw6f
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a...
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
GHSA-h989-3vfv-vw6f- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
CVE-2015-0858- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0858
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
DEBIAN-CVE-2015-0858- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0858
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
- Record
UBUNTU-CVE-2015-0858- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tardiffDebian:12 |
before 0.1-3 | 0.1-3 |
tardiffDebian:13 |
before 0.1-3 | 0.1-3 |
tardiffDebian:14 |
before 0.1-3 | 0.1-3 |
tardiffDebian:7 From an advisory covering 2 CVEs |
before 0.1-1+deb7u1, plus listed versions 0.1-1 |
0.1-1+deb7u1 |
tardiffDebian:8 From an advisory covering 2 CVEs |
before 0.1-2+deb8u2, plus listed versions 0.1-20.1-2+deb8u1 |
0.1-2+deb8u2 |
tardiffUbuntu:14.04:LTS |
before 0.1-2+deb8u2build0.14.04.1, plus listed versions 0.1-2 |
0.1-2+deb8u2build0.14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0858 is a low vulnerability (CVSS 3.3) in Tardiff Project Tardiff, published May 1, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in tardiff 0.1-3.
References
debian.org/security/2016/dsa-3562
anonscm.debian.org/cgit/collab-maint/tardiff.git/commit?id=9bd6a07bc204472ac27242cea16f89943b43003a
nvd.nist.gov/vuln/detail/CVE-2015-0858
github.com/advisories/GHSA-h989-3vfv-vw6f
security-tracker.debian.org/tracker/CVE-2015-0858
ubuntu.com/security/CVE-2015-0858
cve.org/CVERecord?id=CVE-2015-0858