CVE-2015-1327: Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access
Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1327?
CVE-2015-1327 is considered to have a medium severity due to potential unauthorized file transfer capabilities.
How do I fix CVE-2015-1327?
To fix CVE-2015-1327, upgrade to Content Hub version 0.0+15.04.20150331-0ubuntu1.0 or later.
What software is affected by CVE-2015-1327?
CVE-2015-1327 affects Content Hub prior to version 0.0+15.04.20150331-0ubuntu1.0 on Ubuntu 15.04.
Can a malicious application exploit CVE-2015-1327?
Yes, a malicious application can exploit CVE-2015-1327 to access files it shouldn't have permission to.
What does CVE-2015-1327 involve regarding file access?
CVE-2015-1327 involves the DBUS API not enforcing file access controls, allowing restricted file transfers.