{"id":"CVE-2015-1322","aliases":["EUVD-2015-1463","GHSA-w22p-5rfg-4229","UBUNTU-CVE-2015-1322","USN-2581-1"],"status":"published","title":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before...","description":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).","severity":{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00534,"percentile":0.45387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2015-04-28T00:00:00Z","modified":"2026-06-17T00:22:11Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"network-manager","fixed_in":["0.9.8.8-0ubuntu7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"network-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8.8-0ubuntu7.1"}]}],"versions":["0.9.8.0-0ubuntu22","0.9.8.4-0ubuntu3","0.9.8.8-0ubuntu1","0.9.8.8-0ubuntu4","0.9.8.8-0ubuntu5","0.9.8.8-0ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"network-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8.8-0ubuntu7.1"}]}],"versions":["0.9.8.0-0ubuntu22","0.9.8.4-0ubuntu3","0.9.8.8-0ubuntu1","0.9.8.8-0ubuntu4","0.9.8.8-0ubuntu5","0.9.8.8-0ubuntu7"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"ubuntu","product":"network-manager"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/%2Bsource/network-manager/%2Bbug/1449245","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-2581-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1322"},{"url":"https://github.com/advisories/GHSA-w22p-5rfg-4229"},{"url":"https://ubuntu.com/security/CVE-2015-1322","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2581-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1322","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1322","description":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).","status":"published","published":"2015-04-29T20:00:00Z","modified":"2024-08-06T04:40:18.319Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1463","description":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).","status":"published","published":"2015-04-29T20:00:00Z","modified":"2024-08-06T04:40:18Z","updated_at":"2026-11-03T02:22:16.145787Z"}],"ghsa":[{"id":"GHSA-w22p-5rfg-4229","title":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before...","description":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).","status":"published","published":"2022-05-17T03:54:50Z","modified":"2023-01-28T05:00:43Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:43:23.885547Z"}],"nvd":[{"id":"CVE-2015-1322","description":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).","status":"published","published":"2015-04-29T20:59:01.247Z","modified":"2026-06-17T00:22:11.583Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"UBUNTU-CVE-2015-1322","description":"Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).","status":"published","published":"2015-04-28T00:00:00Z","modified":"2026-04-22T10:02:13.957789Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2581-1","title":"network-manager vulnerability","description":"Tavis Ormandy discovered that NetworkManager incorrectly filtered paths\nwhen requested to read modem device contexts. A local attacker could\npossibly use this issue to bypass privileges and manipulate modem device\nconfiguration or read arbitrary files.\n","status":"published","published":"2015-04-28T13:55:38Z","modified":"2026-04-22T09:12:16.675679Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}