Every CVESearch/Get API key

CVE-2015-3239

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows...

3.3 LowPublic exploitFix available

CVE-2015-3239 is a low vulnerability (CVSS 3.3) in Libunwind Project Libunwind, published July 12, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in android-platform-external-libunwind 7.0.0+r1-4.

What does this mean?
Severity
3.3 LowCVSS 2.0, NVD
Exploit chance
0.50%EPSS, 43rd percentile
Exploitation
None known3 public exploits
Fixed in
7.0.0+r1-4android-platform-external-libunwind +32 more

Description

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Exploit likelihood

0.50%Down 0.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
android-platform-external-libunwind
Debian:12
before 7.0.0+r1-4
7.0.0+r1-4
android-platform-external-libunwind
Debian:13
before 7.0.0+r1-4
7.0.0+r1-4
libunwind
Debian:12
before 1.1-4
1.1-4
libunwind
Debian:13
before 1.1-4
1.1-4
libunwind
Debian:14
before 1.1-4
1.1-4
libunwind
Debian:6.0
before 0.99-0.2+deb6u1, plus listed versions
0.99-0.2
0.99-0.2+deb6u1
libunwind
Mageia:4
before 1.1-2.1.mga4
1.1-2.1.mga4
libunwind
Mageia:5
before 1.1-4.1.mga5
1.1-4.1.mga5
libunwind
Red Hat:openstack:6::el7
before 0:1.1-4.1.el7ost
0:1.1-4.1.el7ost
libunwind-debuginfo
Red Hat:openstack:6::el7
before 0:1.1-4.1.el7ost
0:1.1-4.1.el7ost
Show 23 moreShow less
Affected packages
PackageAffectedFixed
libunwind
Red Hat:openstack:5::el6
before 0:1.1-4.1.el6ost
0:1.1-4.1.el6ost
libunwind-debuginfo
Red Hat:openstack:5::el6
before 0:1.1-4.1.el6ost
0:1.1-4.1.el6ost
libunwind
Red Hat:openstack:5::el7
before 0:1.1-4.1.el7ost
0:1.1-4.1.el7ost
libunwind-debuginfo
Red Hat:openstack:5::el7
before 0:1.1-4.1.el7ost
0:1.1-4.1.el7ost
libunwind-devel
Red Hat:openstack:5::el7
before 0:1.1-4.1.el7ost
0:1.1-4.1.el7ost
libunwind
SUSE:Linux Enterprise Desktop 12 SP3
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Desktop 12 SP4
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Software Development Kit 12 SP3
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Software Development Kit 12 SP4
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Server 12 SP3
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Server 12 SP4
before 1.1-11.3.1
1.1-11.3.1
libunwind
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
before 1.1-11.3.1
1.1-11.3.1
android-platform-external-libunwind
Ubuntu:16.04:LTS
All versions, plus listed versions
5.1.1+r8-16.0.0+r26-36.0.1+r16-16.0.1+r16-2
None known
racket
Ubuntu:16.04:LTS
All versions, plus listed versions
6.2-26.2-36.3-1
None known
racket
Ubuntu:18.04:LTS
All versions, plus listed versions
6.9-26.11+dfsg1-1
None known
racket
Ubuntu:20.04:LTS
All versions, plus listed versions
7.2+dfsg1-2ubuntu27.2+dfsg1-2ubuntu3
None known
racket
Ubuntu:22.04:LTS
All versions, plus listed versions
7.9+dfsg1-2build18.2+dfsg1-28.2+dfsg1-2ubuntu1
None known
racket
Ubuntu:24.04:LTS
All versions, plus listed versions
8.7+dfsg1-18.10+dfsg1-28.10+dfsg1-2ubuntu1
None known
racket
Ubuntu:25.10
All versions, plus listed versions
8.12+dfsg1-7ubuntu18.16+dfsg1-3ubuntu2
None known
racket
Ubuntu:26.10
All versions, plus listed versions
8.18+dfsg1-1ubuntu1
None known
racket
Ubuntu:26.04:LTS
All versions, plus listed versions
8.16+dfsg1-3ubuntu28.18+dfsg1-1ubuntu1
None known
libunwind
openSUSE:Tumbleweed
before 1.2~rc1-2.3
1.2~rc1-2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubRenukaSelvar/libunwind_CVE-2015-32392024-11-04
PoC in GitHubRenukaSelvar/libunwind_CVE-2015-3239_After2024-11-04
PoC in GitHubRenukaSelvar/libunwind_CVE-2015-3239_AfterPatch2024-11-04

What each source reports

NVD Score used3.3

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
CVE-2015-3239
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-189
Updated
2026-11-02
CVE ListNo score

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
CVE-2015-3239
Updated
2026-11-02
EUVDEUVD-2015-3295No score

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
EUVD-2015-3295
Updated
2026-11-03
GitHub AdvisoriesGHSA-5mwh-64pf-674pNo score

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows...

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
GHSA-5mwh-64pf-674p
Updated
2026-11-02
OSVNo score

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
CVE-2015-3239
Updated
2026-11-02
OSVDEBIAN-CVE-2015-3239No score

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
DEBIAN-CVE-2015-3239
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2015-0307No score

Updated libunwind package fixes security vulnerability

An invalid DW_OP_bregXX opcodes can access dwarf_to_unw_regnum_map one item past the end (CVE-2015-3239).

Record
MGASA-2015-0307
Updated
2026-11-02
OSVopenSUSE-SU-2024:10288-1No score

libunwind-1.2~rc1-2.3 on GA media

These are all security issues fixed in the libunwind-1.2~rc1-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10288-1
Updated
2026-11-02
OSVSUSE-SU-2019:0284-1No score

Security update for libunwind

This update for libunwind fixes the following issues:

Security issues fixed:

  • CVE-2015-3239: Fixed a off-by-one in the dwarf_to_unw_regnum function (bsc#936786)

Non-security issues fixed:

  • Fixed a dependency issue with libzmq5 (bsc#1122012)
  • Fixed build on armv7 (bsc#976955)
Record
SUSE-SU-2019:0284-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-3239No score

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

Record
UBUNTU-CVE-2015-3239
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 22 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open