{"id":"CVE-2015-8787","aliases":["DEBIAN-CVE-2015-8787","EUVD-2015-8659","GHSA-959v-vp3p-vw6v","UBUNTU-CVE-2015-8787","USN-2889-2","USN-2890-2"],"status":"published","title":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4...","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09235,"percentile":0.95385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2015-12-31T00:00:00Z","modified":"2026-09-09T07:01:24Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.3.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-49.55~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","fixed_in":["4.2.0-27.32~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-49.55~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-27.32~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-49.55~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-27.32~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1"],"bundled":9}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/01/27/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/torvalds/linux/commit/94f9cd81436c85d8c3a318ba92e236ede73752fc","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.ubuntu.com/usn/USN-2890-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2889-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2889-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2890-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2890-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300731","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8787"},{"url":"https://github.com/advisories/GHSA-959v-vp3p-vw6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8787","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8787","tags":["report"]},{"url":"https://lkml.org/lkml/2015/12/2/618","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2889-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2889-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2890-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2890-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2890-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8575","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8787","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2016-02-08T02:00:00Z","modified":"2024-08-06T08:29:22.037Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8659","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2016-02-08T02:00:00Z","modified":"2024-08-06T08:29:22Z","updated_at":"2026-11-03T01:57:25.869767Z"}],"ghsa":[{"id":"GHSA-959v-vp3p-vw6v","title":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4...","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2022-05-13T01:04:11Z","modified":"2023-02-01T05:02:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:49:57.916243Z"}],"nvd":[{"id":"CVE-2015-8787","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2016-02-08T03:59:08.807Z","modified":"2026-06-17T00:35:15.07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"CVE-2015-8787","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2016-02-08T03:59:08Z","modified":"2026-04-10T03:45:35.80636Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8787","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2016-02-08T03:59:08.807Z","modified":"2026-09-09T07:01:24.665914829Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8787","description":"The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.","status":"published","published":"2015-12-31T00:00:00Z","modified":"2026-02-04T02:31:17.294334Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"USN-2889-2","title":"linux-lts-vivid vulnerabilities","description":"It was discovered that a use-after-free vulnerability existed in the\nAF_UNIX implementation in the Linux kernel. A local attacker could use\ncrafted epoll_ctl calls to cause a denial of service (system crash) or\nexpose sensitive information. (CVE-2013-7446)\n\nIt was discovered that the KVM implementation in the Linux kernel did not\nproperly restore the values of the Programmable Interrupt Timer (PIT). A\nuser-assisted attacker in a KVM guest could cause a denial of service in\nthe host (system crash). (CVE-2015-7513)\n\nSasha Levin discovered that the Reliable Datagram Sockets (RDS)\nimplementation in the Linux kernel had a race condition when checking\nwhether a socket was bound or not. A local attacker could use this to cause\na denial of service (system crash). (CVE-2015-7990)\n\nIt was discovered that the Btrfs implementation in the Linux kernel\nincorrectly handled compressed inline extants on truncation. A local\nattacker could use this to expose sensitive information. (CVE-2015-8374)\n\nIt was discovered that the netfilter Network Address Translation (NAT)\nimplementation did not ensure that data structures were initialized when\nhandling IPv4 addresses. An attacker could use this to cause a denial of\nservice (system crash). (CVE-2015-8787)\n","status":"published","published":"2016-02-02T01:57:57Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2890-2","title":"linux-lts-wily vulnerabilities","description":"It was discovered that a use-after-free vulnerability existed in the\nAF_UNIX implementation in the Linux kernel. A local attacker could use\ncrafted epoll_ctl calls to cause a denial of service (system crash) or\nexpose sensitive information. (CVE-2013-7446)\n\nIt was discovered that the KVM implementation in the Linux kernel did not\nproperly restore the values of the Programmable Interrupt Timer (PIT). A\nuser-assisted attacker in a KVM guest could cause a denial of service in\nthe host (system crash). (CVE-2015-7513)\n\nIt was discovered that the Linux kernel keyring subsystem contained a race\nbetween read and revoke operations. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2015-7550)\n\nSasha Levin discovered that the Reliable Datagram Sockets (RDS)\nimplementation in the Linux kernel had a race condition when checking\nwhether a socket was bound or not. A local attacker could use this to cause\na denial of service (system crash). (CVE-2015-7990)\n\nIt was discovered that the Btrfs implementation in the Linux kernel\nincorrectly handled compressed inline extants on truncation. A local\nattacker could use this to expose sensitive information. (CVE-2015-8374)\n\n郭永刚 discovered that the Linux kernel networking implementation did\nnot validate protocol identifiers for certain protocol families, A local\nattacker could use this to cause a denial of service (system crash) or\npossibly gain administrative privileges. (CVE-2015-8543)\n\nDmitry Vyukov discovered that the pptp implementation in the Linux kernel\ndid not verify an address length when setting up a socket. A local attacker\ncould use this to craft an application that exposed sensitive information\nfrom kernel memory. (CVE-2015-8569)\n\nDavid Miller discovered that the Bluetooth implementation in the Linux\nkernel did not properly validate the socket address length for Synchronous\nConnection-Oriented (SCO) sockets. A local attacker could use this to\nexpose sensitive information. (CVE-2015-8575)\n\nIt was discovered that the netfilter Network Address Translation (NAT)\nimplementation did not ensure that data structures were initialized when\nhandling IPv4 addresses. An attacker could use this to cause a denial of\nservice (system crash). (CVE-2015-8787)\n","status":"published","published":"2016-02-02T02:13:01Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}