{"id":"CVE-2015-7763","aliases":["DEBIAN-CVE-2015-7763","DLA-342-1","DSA-3387-1","EUVD-2015-7663","GHSA-jfjc-3x9j-qg99","MGASA-2015-0424","UBUNTU-CVE-2015-7763"],"status":"published","title":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not...","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02133,"percentile":0.82109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-11-01T00:00:00Z","modified":"2026-09-09T06:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"openafs","fixed_in":["1.6.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openafs","fixed_in":["1.6.15-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openafs","fixed_in":["1.6.7-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.15-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.12.1+dfsg-4+squeeze4"}]}],"versions":["1.4.12.1+dfsg-3","1.4.12.1+dfsg-4","1.4.12.1+dfsg-4+squeeze1","1.4.12.1+dfsg-4+squeeze2","1.4.12.1+dfsg-4+squeeze3","1.4.12.1+dfsg-4~bpo50+1"],"bundled":6},{"source":"osv","ecosystem":"Debian:7","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-3+deb7u5"}]}],"versions":["1.6.1-3","1.6.1-3+deb7u1","1.6.1-3+deb7u1~bpo60+1","1.6.1-3+deb7u2","1.6.1-3+deb7u2~bpo60+1","1.6.1-3+deb7u3","1.6.1-3+deb7u4"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2+deb8u4"}]}],"versions":["1.6.9-2+deb8u2","1.6.9-2+deb8u3","1.6.9-2+deb8u4~bpo70+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.15-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu1.1"}]}],"versions":["1.6.5-1ubuntu3","1.6.5.1-1","1.6.5.1-1ubuntu1","1.6.6~pre2-1","1.6.6-1","1.6.7-1","1.6.7-1ubuntu1"]}],"products":[{"vendor":"openafs","product":"openafs"}],"references":[{"url":"https://www.openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.openafs.org/pipermail/openafs-announce/2015/000493.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1034039","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3387","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7763"},{"url":"https://github.com/advisories/GHSA-jfjc-3x9j-qg99"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-7763","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0424.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17050","tags":["report"]},{"url":"http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt","tags":["web"]},{"url":"http://openafs.org/dl/openafs/1.6.14/RELNOTES-1.6.14","tags":["web"]},{"url":"http://openafs.org/dl/openafs/1.6.14.1/RELNOTES-1.6.14.1","tags":["web"]},{"url":"http://openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-7763","tags":["report"]},{"url":"https://www.openafs.org/security","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7763","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-7763","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2015-11-06T21:00:00Z","modified":"2024-08-06T07:59:00.543Z","updated_at":"2026-11-02T14:35:44.744952Z"}],"euvd":[{"id":"EUVD-2015-7663","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2015-11-06T21:00:00Z","modified":"2024-08-06T07:59:00Z","updated_at":"2026-11-03T02:21:50.987466Z"}],"ghsa":[{"id":"GHSA-jfjc-3x9j-qg99","title":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not...","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2022-05-17T03:25:31Z","modified":"2023-01-27T05:07:26Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:43:07.326529Z"}],"nvd":[{"id":"CVE-2015-7763","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2015-11-06T21:59:11.377Z","modified":"2026-06-17T00:33:05.607Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"CVE-2015-7763","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2015-11-06T21:59:11Z","modified":"2026-04-16T06:24:01.050720146Z","updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-7763","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2015-11-06T21:59:11.377Z","modified":"2026-09-09T06:47:32.877160478Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"DLA-342-1","title":"openafs - security update","status":"published","published":"2015-11-17T00:00:00Z","modified":"2026-03-09T01:23:01.110889Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3387-1","title":"openafs - security update","status":"published","published":"2015-11-01T00:00:00Z","modified":"2026-03-09T01:20:48.350227Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0424","title":"Updated openafs packages fix security vulnerabilities","description":"Updated openafs packages fix security vulnerabilities:\n\nWhen constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx\nimplementations do not initialize three octets of data that are padding\nin the C language structure and were inadvertently included in the wire\nprotocol (CVE-2015-7762).\n\nAdditionally, OpenAFS Rx before version 1.6.14 includes a variable-length\npadding at the end of the ACK packet, in an attempt to detect the path MTU,\nbut only four octets of the additional padding are initialized\n(CVE-2015-7763).\n","status":"published","published":"2015-11-02T20:21:29Z","modified":"2026-04-16T06:24:32.015506572Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-7763","description":"rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.","status":"published","published":"2015-11-06T21:59:00Z","modified":"2026-04-22T10:18:49.742332Z","updated_at":"2026-11-02T15:54:10.737723Z"}]}}