CVE-2015-7763
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not...
CVE-2015-7763 is a medium vulnerability (CVSS 5.0) in Openafs, published November 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in openafs 1.6.15-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.13%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.6.15-1openafs +6 more
Description
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsDebian:12 | before 1.6.15-1 | 1.6.15-1 |
openafsDebian:13 | before 1.6.15-1 | 1.6.15-1 |
openafsDebian:6.0 From an advisory covering 6 CVEs | before 1.4.12.1+dfsg-4+squeeze4, plus listed versions 1.4.12.1+dfsg-31.4.12.1+dfsg-41.4.12.1+dfsg-4+squeeze11.4.12.1+dfsg-4+squeeze21.4.12.1+dfsg-4+squeeze31.4.12.1+dfsg-4~bpo50+1 | 1.4.12.1+dfsg-4+squeeze4 |
openafsDebian:7 From an advisory covering 2 CVEs | before 1.6.1-3+deb7u5, plus listed versions 1.6.1-31.6.1-3+deb7u11.6.1-3+deb7u1~bpo60+11.6.1-3+deb7u21.6.1-3+deb7u2~bpo60+11.6.1-3+deb7u31.6.1-3+deb7u4 | 1.6.1-3+deb7u5 |
openafsDebian:8 From an advisory covering 2 CVEs | before 1.6.9-2+deb8u4, plus listed versions 1.6.9-2+deb8u21.6.9-2+deb8u31.6.9-2+deb8u4~bpo70+1 | 1.6.9-2+deb8u4 |
openafsMageia:5 From an advisory covering 2 CVEs | before 1.6.15-1.mga5 | 1.6.15-1.mga5 |
openafsUbuntu:14.04:LTS | before 1.6.7-1ubuntu1.1, plus listed versions 1.6.5-1ubuntu31.6.5.1-11.6.5.1-1ubuntu11.6.6~pre2-11.6.6-11.6.7-11.6.7-1ubuntu1 | 1.6.7-1ubuntu1.1 |
What each source reports
NVD Score used
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
CVE-2015-7763- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
CVE-2015-7763- Updated
- 2026-11-02
EUVDEUVD-2015-7663No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
EUVD-2015-7663- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jfjc-3x9j-qg99No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not...
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
GHSA-jfjc-3x9j-qg99- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
CVE-2015-7763- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7763No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
DEBIAN-CVE-2015-7763- Updated
- 2026-11-02
OSVMGASA-2015-0424No score
Updated openafs packages fix security vulnerabilities
Updated openafs packages fix security vulnerabilities:
When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx implementations do not initialize three octets of data that are padding in the C language structure and were inadvertently included in the wire protocol (CVE-2015-7762).
Additionally, OpenAFS Rx before version 1.6.14 includes a variable-length padding at the end of the ACK packet, in an attempt to detect the path MTU, but only four octets of the additional padding are initialized (CVE-2015-7763).
- Record
MGASA-2015-0424- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7763No score
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
- Record
UBUNTU-CVE-2015-7763- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15
lists.openafs.org/pipermail/openafs-announce/2015/000493.html
securitytracker.com/id/1034039
debian.org/security/2015/dsa-3387
nvd.nist.gov/vuln/detail/CVE-2015-7763
Show 9 moreShow less
github.com/advisories/GHSA-jfjc-3x9j-qg99
security-tracker.debian.org/tracker/CVE-2015-7763
advisories.mageia.org/MGASA-2015-0424.html
bugs.mageia.org/show_bug.cgi?id=17050
openafs.org/dl/openafs/1.6.14/RELNOTES-1.6.14
ubuntu.com/security/CVE-2015-7763
cve.org/CVERecord?id=CVE-2015-7763