{"id":"CVE-2015-0278","aliases":["EUVD-2015-0291","GHSA-hmvq-6hjm-q8hj","MGASA-2015-0186"],"status":"published","title":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent...","description":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03242,"percentile":0.88392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-273"],"published":"2015-05-05T13:36:50Z","modified":"2026-06-17T00:19:53Z","fixes":[{"ecosystem":"Mageia:4","package":"nodejs","fixed_in":["0.10.38-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:4","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.38-1.mga4"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libuv_project","product":"libuv"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://groups.google.com/forum/#%21msg/libuv/0JZxwLMtsMI/jraczskYWWQJ","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:228","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory"]},{"url":"http://advisories.mageia.org/MGASA-2015-0186.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-February/150526.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/libuv/libuv/pull/215","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://github.com/libuv/libuv/commit/66ab38918c911bcff025562cf06237d7fedaba0c","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201611-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0278"},{"url":"https://groups.google.com/forum/#!msg/libuv/0JZxwLMtsMI/jraczskYWWQJ"},{"url":"https://github.com/advisories/GHSA-hmvq-6hjm-q8hj"},{"url":"https://advisories.mageia.org/MGASA-2015-0186.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15405","tags":["report"]},{"url":"http://blog.nodejs.org/2014/12/17/node-v0-10-34-stable/","tags":["web"]},{"url":"http://blog.nodejs.org/2014/12/23/node-v0-10-35-stable/","tags":["web"]},{"url":"http://blog.nodejs.org/2015/01/26/node-v0-10-36-stable/","tags":["web"]},{"url":"http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable/","tags":["web"]},{"url":"http://blog.nodejs.org/2015/03/23/node-v0-10-38-maintenance/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-0278","description":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.","status":"published","published":"2015-05-18T15:00:00Z","modified":"2024-08-06T04:03:10.551Z","updated_at":"2026-11-02T14:35:45.428221Z"}],"euvd":[{"id":"EUVD-2015-0291","description":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.","status":"published","published":"2015-05-18T15:00:00Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.481932Z"}],"ghsa":[{"id":"GHSA-hmvq-6hjm-q8hj","title":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent...","description":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.","status":"published","published":"2022-05-14T03:07:29Z","modified":"2023-02-20T05:05:22Z","cwes":["CWE-273"],"updated_at":"2026-11-02T14:54:10.77374Z"}],"nvd":[{"id":"CVE-2015-0278","description":"libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.","status":"published","published":"2015-05-18T15:59:02.713Z","modified":"2026-06-17T00:19:53.87Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"MGASA-2015-0186","title":"Updated nodejs packages fix security vulnerabilities","description":"Updated nodejs package fixes security vulnerability:\n\nIt was found that libuv does not call setgoups before calling setuid/setgid.\nThis may potentially allow an attacker to gain elevated privileges\n(CVE-2015-0278).\n\nThe libuv library is bundled with nodejs, and a fixed version of libuv is\nincluded with nodejs as of version 0.10.37.  The nodejs package has been\nupdated to version 0.10.38 to fix this issue, as well as several other bugs.\n","status":"published","published":"2015-05-05T13:36:50Z","modified":"2026-04-16T06:26:16.729887919Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}