{"id":"CVE-2015-5224","aliases":["DEBIAN-CVE-2015-5224","EUVD-2015-5220","GHSA-g2jw-fqx3-5mwq","MGASA-2015-0352"],"status":"published","title":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers...","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04526,"percentile":0.91603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377"],"published":"2015-09-08T17:55:59Z","modified":"2026-09-09T07:01:06Z","fixes":[{"ecosystem":"Debian:12","package":"util-linux","fixed_in":["2.27-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"util-linux","fixed_in":["2.27-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.27-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"util-linux","fixed_in":["2.25.2-3.1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.2-3.1.mga5"}]}]}],"products":[{"vendor":"kernel","product":"util-linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1256686","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/76467","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/08/24/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://github.com/karelzak/util-linux/commit/bde91c85bdc77975155058276f99d2e0f5eab5a9","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5224"},{"url":"https://github.com/advisories/GHSA-g2jw-fqx3-5mwq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5224","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0352.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16641","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/08/24/3","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5224","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","status":"published","published":"2017-08-23T15:00:00Z","modified":"2025-12-04T20:03:59.057Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5220","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","status":"published","published":"2017-08-23T15:00:00Z","modified":"2025-12-04T20:03:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:09.83206Z"}],"ghsa":[{"id":"GHSA-g2jw-fqx3-5mwq","title":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers...","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","status":"published","published":"2022-05-13T01:16:19Z","modified":"2025-12-04T21:31:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:05:03.172685Z"}],"nvd":[{"id":"CVE-2015-5224","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","status":"published","published":"2017-08-23T15:29:00.207Z","modified":"2026-06-17T00:28:42.577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"CVE-2015-5224","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","status":"published","published":"2017-08-23T15:29:00Z","modified":"2026-04-16T06:25:02.251590404Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5224","description":"The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.","status":"published","published":"2017-08-23T15:29:00.207Z","modified":"2026-09-09T07:01:06.654346297Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0352","title":"Updated util-linux packages fix CVE-2015-5224","description":"Updated util-linux packages fix security vulnerability:\n\nThe chfn and chsh commands in util-linux's login-utils are vulnerable to a\nfile name collision due to incorrect mkstemp usage. If the chfn and chsh\nbinaries are both setuid-root they eventually call mkostemp in such a way that\nan attacker could repeatedly call them and eventually be able to overwrite\ncertain files in /etc (CVE-2015-5224).\n","status":"published","published":"2015-09-08T17:55:59Z","modified":"2026-04-16T06:22:32.662496528Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}